Custom fail2ban Filter for phpMyadmin bruteforce attempts

That's fine but why not using the apache functionality to log failed logins ?

Add these lines to your Apache Config (i.e:/etc/apache2/conf.d/phpmyadmin.conf) in the according VirtualHost Section:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{userID}n %{userStatus}n" pma_combined
CustomLog /var/log/apache2/phpmyadmin_access.log pma_combined

Then create the fail2ban filter:

/etc/fail2ban/filter.d/phpmyadmin.conf

[Definition]
denied = mysql-denied|allow-denied|root-denied|empty-denied
failregex = ^<HOST> -.*(?:%(denied)s)$
ignoreregex =

Now add the jail to /etc/fail2ban/jail.local

[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
logpath = /var/log/apache2/phpmyadmin_access.log

Restart apache and fail2ban:

service  apache2 reload
service fail2ban reload

and you are done, no need of php scripts so on..

1. You should change your script to include timestamp in log files. Without this, fail2ban will not work

2. use fail2ban-regex /var/log/phpmyadmin_auth.log /etc/fail2ban/filter.d/phpmyadmin.conf to verify your regex first.

3. I could start fail2ban successfully using your original configuration (prior to jail.local)

   Oct  7 00:42:07 hostname yum: Installed: python-inotify-0.9.1-1.el5.noarch 
   Oct  7 00:42:08 hostname yum: Installed: fail2ban-0.8.4-29.el5.noarch
   Oct  7 00:42:10 hostname yum: Installed: phpMyAdmin-2.11.11.3-2.el5.noarch
   Oct  7 01:01:03 hostname fail2ban.server : INFO   Changed logging target to SYSLOG for Fail2ban v0.8.4
   Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Creating new jail 'phpmyadmin'
   Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Jail 'phpmyadmin' uses Gamin
   Oct  7 01:01:03 hostname fail2ban.filter : INFO   Set maxRetry = 2
   Oct  7 01:01:03 hostname fail2ban.filter : INFO   Set findtime = 600
   Oct  7 01:01:03 hostname fail2ban.actions: INFO   Set banTime = 600
   Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Creating new jail 'ssh-iptables'
   Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Jail 'ssh-iptables' uses Gamin
   Oct  7 01:01:03 hostname fail2ban.filter : INFO   Added logfile = /var/log/secure
   Oct  7 01:01:03 hostname fail2ban.filter : INFO   Set maxRetry = 5
   Oct  7 01:01:03 hostname fail2ban.filter : INFO   Set findtime = 600
   Oct  7 01:01:03 hostname fail2ban.actions: INFO   Set banTime = 600
   Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Jail 'phpmyadmin' started
   Oct  7 01:01:03 hostname fail2ban.jail   : INFO   Jail 'ssh-iptables' started
   Oct  7 01:10:54 hostname fail2ban.jail   : INFO   Jail 'phpmyadmin' stopped
   Oct  7 01:10:55 hostname fail2ban.jail   : INFO   Jail 'ssh-iptables' stopped
   Oct  7 01:10:55 hostname fail2ban.server : INFO   Exiting Fail2ban
   Oct  7 01:10:56 hostname fail2ban.server : INFO   Changed logging target to SYSLOG for Fail2ban v0.8.4
   Oct  7 01:10:56 hostname fail2ban.jail   : INFO   Creating new jail 'phpmyadmin'
   Oct  7 01:10:56 hostname fail2ban.jail   : INFO   Jail 'phpmyadmin' uses Gamin
   Oct  7 01:10:56 hostname fail2ban.filter : INFO   Added logfile = /var/log/phpmyadmin_auth.log
   

4. Once correct regex are in place, you can use audit to see whether your file is accessed or not by fail2ban.

I used auditctl -w /var/log/phpmyadmin_auth.log -p warx -k phpmyadmin_fail2ban