Knowledgebase

Xmlrpc is a type of attack in which your site goes down and if you see the error log of nginx
tailf /var/log/nginx/error.log  then there will be several xmlrpc request error. here is the fix for this.
Here is the steps i used to fix this issue with Fail2ban.

# apt-get install fail2ban iptables

# cd /etc/fail2ban

# cp jail.conf jail.local

# vim jail.local

Paste and append bellow lines at the end of file

[xmlrpc]
enabled = true
filter = xmlrpc
action = iptables[name=xmlrpc, port=http, protocol=tcp]
logpath = /var/log/nginx/access.log
bantime = 43600
maxretry = 2

Save.Now Create a fail2ban filter for this.

# vim /etc/fail2ban/filter.d/xmlrpc.conf

[Definition]
failregex = ^<HOST> .*POST .*xmlrpc\.php.*
ignoreregex =

Save and exit

# service fail2ban restart