Security Audit for Club Websites under Virtualmin: Configuring Fail2ban, ModSecurity, and Two-Factor Authentication Correctly

Why Security Matters for Club Websites

Club websites often contain sensitive data such as member lists, donation information, or internal documents. A security incident can not only cause financial damage but also undermine members' trust. If you run your website on a virtual server with Virtualmin, you already have a solid foundation. However, without regular security audits and proper configuration of tools like Fail2ban, ModSecurity, and two-factor authentication (2FA), your website remains vulnerable. In this article, we show you how to properly set up these three important security components under Virtualmin.

Fail2ban: Protection Against Brute-Force Attacks

Fail2ban is an intrusion prevention tool that monitors log files and automatically sets firewall rules to block attacking IP addresses upon suspicious activity. Under Virtualmin, Fail2ban is often preinstalled but not always optimally configured.

Installation and Basic Configuration

First, check if Fail2ban is installed:

sudo apt install fail2ban

The main configuration is done in /etc/fail2ban/jail.local. Create this file if it does not exist and add the following basic settings:

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5
ignoreip = 127.0.0.1/8

These values mean: An IP is banned for 1 hour if it makes 5 failed login attempts within 10 minutes. Adjust ignoreip to exclude your own IP or trusted networks.

Enable Jails for Virtualmin and Web Server

Virtualmin uses its own log files. Enable the relevant jails by adding the following to jail.local:

[ssh]
enabled = true

[apache-auth]
enabled = true

[apache-badbots]
enabled = true

[webmin-auth]
enabled = true

For Virtualmin-specific jails, you can also use the included filters. Restart Fail2ban and check the status:

sudo systemctl restart fail2ban
sudo fail2ban-client status

ModSecurity: Web Application Firewall for Your Club Website

ModSecurity is a Web Application Firewall (WAF) that analyzes HTTP requests and blocks malicious patterns. In combination with the OWASP Core Rule Set (CRS), it provides robust protection against SQL injection, XSS, and other attacks.

Installation under Virtualmin

Virtualmin offers an easy way to install ModSecurity. Go to System Settings → Features and Plugins and enable ModSecurity. Alternatively, install it manually:

sudo apt install libapache2-mod-security2

Enable the module and copy the recommended configuration:

sudo a2enmod security2
sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

Integrate OWASP Core Rule Set

Download the OWASP CRS and extract it to /etc/modsecurity/crs/. Then add the following lines to your Apache configuration:

Include /etc/modsecurity/crs/crs-setup.conf
Include /etc/modsecurity/crs/rules/*.conf

Set SecRuleEngine On in modsecurity.conf to enable protection. Test thoroughly to avoid false positives. Monitor the audit log at /var/log/modsec_audit.log.

Two-Factor Authentication (2FA) for Virtualmin and Web Applications

2FA is one of the most effective measures to prevent unauthorized access. Virtualmin supports 2FA for logging into the Control Panel. Additionally, you should enable 2FA for all web applications (e.g., WordPress).

Enable 2FA in Virtualmin

Log in as administrator, go to Webmin → Webmin Users and select your user. Under Two-Factor Authentication, enable the option and scan the QR code with an app like Google Authenticator or Authy.

2FA for WordPress and Other CMS

For WordPress, there are plugins such as Two Factor Authentication or Wordfence. Install one of them and configure it for all users with write permissions. Enforce 2FA for administrators to increase security.

Regular Audits and Best Practices

A one-time audit is not enough. Regularly perform the following steps:

• Check Fail2ban logs for recurring attacks and adjust the rules.
• Update ModSecurity rules and the OWASP CRS monthly.
• Test the 2FA setup and keep backup codes safe.
• Perform security scans with tools like Nikto or WPScan.
• Keep Virtualmin and all components up to date.

If you run your club website on a web hosting package, ensure that your provider performs regular security updates. With a virtual server, the responsibility lies with you – making the measures described here all the more important.

Conclusion: Security is Not a State but a Process

With Fail2ban, ModSecurity, and 2FA, you can significantly improve the security of your club website under Virtualmin. The configuration requires some familiarization, but the effort is worth it. Remember: Security is not a one-time project but an ongoing process. Regular audits and updates are essential to ward off new threats.