Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- fail2ban [31.01.2024] – [Beste Vorgehensweise] hochrath
+++ fail2ban [31.01.2024] (aktuell) – [Quellen] hochrath
@@ Zeile 229: / Zeile 229: @@
 \\
 Nun kann man über die Log-Files sehr schön den Verlauf bei einem fehlerhaften Zugriff beobachten:\\
+**service fail2ban status**
 <code>
-root@raspberrypi3:/home/pi# **service fail2ban status**
+root@raspberrypi3:/home/pi# service fail2ban status
 ● fail2ban.service - Fail2Ban Service
      Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
@@ Zeile 247: / Zeile 248: @@
 </code>
+\\
+**iptables -L**
 <code>
+root@raspberrypi3:/home/pi# iptables -L
+Chain INPUT (policy ACCEPT)
+target     prot opt source               destination
+f2b-apache404  tcp  --  anywhere             anywhere             multiport dports http,https
+Chain FORWARD (policy ACCEPT)
+target     prot opt source               destination
+Chain OUTPUT (policy ACCEPT)
+target     prot opt source               destination
+Chain f2b-apache404 (1 references)
+target     prot opt source               destination
+RETURN     all  --  anywhere             anywhere
 </code>
+\\
+**fail2ban-client status apache404**
 <code>
+root@raspberrypi3:/home/pi# fail2ban-client status apache404
+Status for the jail: apache404
+|- Filter
+|  |- Currently failed: 1
+|  |- Total failed:     3
+|  `- File list:        /var/log/apache2/access.log
+`- Actions
+   |- Currently banned: 0
+   |- Total banned:     1
+   `- Banned IP list:
 </code>
+\\
+\\
+nun die Webseite nach fehlenden Seiten abfragen:
+\\
+**tail -f /var/log/fail2ban.log**
 <code>
+-01-31 16:36:58,105 fail2ban.filter         [23836]: INFO    [apache404] Found 192.168.178.36 - 2024-01-31 16:36:58
+-01-31 16:38:13,892 fail2ban.filter         [23836]: INFO    [apache404] Found 192.168.178.36 - 2024-01-31 16:38:13
+-01-31 16:38:14,032 fail2ban.actions        [23836]: NOTICE  [apache404] Ban 192.168.178.36**Fetter Text**
 </code>
+\\
+**fail2ban-client status apache404**
+<code>
+root@raspberrypi3:/home/pi# fail2ban-client status apache404
+Status for the jail: apache404
+|- Filter
+|  |- Currently failed: 0
+|  |- Total failed:     5
+|  `- File list:        /var/log/apache2/access.log
+`- Actions
+   |- Currently banned: 1
+   |- Total banned:     2
+   `- Banned IP list:   192.168.178.36
+</code>
+\\
+**iptables -L**
+<code>
+root@raspberrypi3:/home/pi# iptables -L
+Chain INPUT (policy ACCEPT)
+target     prot opt source               destination
+f2b-apache404  tcp  --  anywhere             anywhere             multiport dports http,https
+Chain FORWARD (policy ACCEPT)
+target     prot opt source               destination
+Chain OUTPUT (policy ACCEPT)
+target     prot opt source               destination
+Chain f2b-apache404 (1 references)
+target     prot opt source               destination
+REJECT     all  --  DESKTOP-PQ44AIL.fritz.box  anywhere             reject-with icmp-port-unreachable
+RETURN     all  --  anywhere             anywhere
+</code>
@@ Zeile 267: / Zeile 338: @@
+\\
+\\
 ==== Quellen ====
 https://wiki.ubuntuusers.de/fail2ban/\\
 https://www.digitalocean.com/community/tutorials/how-to-protect-ssh-with-fail2ban-on-ubuntu-20-04\\