# Fișier exemplu pentru exercițiul Z5.3 (cursul VPS și administrarea serverelor Linux)
# Serverul "web1" (Debian 13), autentificare doar cu chei, fail2ban cu maxretry = 5, findtime = 10m, bantime = 1h.
# Rezultatul comenzii: sudo journalctl -u ssh --since "2026-11-08 03:00" --until "2026-11-08 09:00"
# și apoi: sudo fail2ban-client status sshd (la ora 09:00). Toate adresele sunt adrese de documentare.

nov 08 03:12:01 web1 sshd-session[1201]: Invalid user admin from 203.0.113.77 port 40112
nov 08 03:12:01 web1 sshd-session[1201]: Connection closed by invalid user admin 203.0.113.77 port 40112 [preauth]
nov 08 03:12:19 web1 sshd-session[1204]: Invalid user oracle from 203.0.113.77 port 40398
nov 08 03:12:19 web1 sshd-session[1204]: Connection closed by invalid user oracle 203.0.113.77 port 40398 [preauth]
nov 08 03:12:40 web1 sshd-session[1210]: Invalid user test from 203.0.113.77 port 40731
nov 08 03:12:40 web1 sshd-session[1210]: Connection closed by invalid user test 203.0.113.77 port 40731 [preauth]
nov 08 03:13:02 web1 sshd-session[1215]: Invalid user ubuntu from 203.0.113.77 port 41020
nov 08 03:13:02 web1 sshd-session[1215]: Connection closed by invalid user ubuntu 203.0.113.77 port 41020 [preauth]
nov 08 03:13:25 web1 sshd-session[1221]: Invalid user postgres from 203.0.113.77 port 41377
nov 08 03:13:25 web1 sshd-session[1221]: Connection closed by invalid user postgres 203.0.113.77 port 41377 [preauth]
nov 08 03:40:12 web1 sshd-session[1302]: Invalid user admin from 198.51.100.140 port 52210
nov 08 03:40:12 web1 sshd-session[1302]: Connection closed by invalid user admin 198.51.100.140 port 52210 [preauth]
nov 08 04:05:44 web1 sshd-session[1350]: Invalid user admin from 198.51.100.140 port 52918
nov 08 04:05:44 web1 sshd-session[1350]: Connection closed by invalid user admin 198.51.100.140 port 52918 [preauth]
nov 08 04:31:09 web1 sshd-session[1399]: Invalid user admin from 198.51.100.140 port 53604
nov 08 04:31:09 web1 sshd-session[1399]: Connection closed by invalid user admin 198.51.100.140 port 53604 [preauth]
nov 08 04:56:30 web1 sshd-session[1441]: Invalid user admin from 198.51.100.140 port 54280
nov 08 04:56:30 web1 sshd-session[1441]: Connection closed by invalid user admin 198.51.100.140 port 54280 [preauth]
nov 08 05:21:58 web1 sshd-session[1490]: Invalid user admin from 198.51.100.140 port 55007
nov 08 05:21:58 web1 sshd-session[1490]: Connection closed by invalid user admin 198.51.100.140 port 55007 [preauth]
nov 08 05:47:21 web1 sshd-session[1532]: Invalid user admin from 198.51.100.140 port 55689
nov 08 05:47:21 web1 sshd-session[1532]: Connection closed by invalid user admin 198.51.100.140 port 55689 [preauth]
nov 08 06:58:03 web1 sshd-session[1604]: Connection closed by authenticating user root 198.51.100.7 port 61002 [preauth]
nov 08 08:31:47 web1 sshd-session[1688]: Accepted publickey for anna from 192.0.2.55 port 50122 ssh2: ED25519 SHA256:q3Vb0Yx8cXk2pR7mW1sTnH4dJ9eLfA6uZ5oGiC2vBQs
nov 08 08:31:47 web1 sshd-session[1688]: pam_unix(sshd:session): session opened for user anna(uid=1000) by anna(uid=0)

anna@web1:~$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     11
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 0
   |- Total banned:     1
   `- Banned IP list:

anna@web1:~$ sudo grep -E "Ban|Unban" /var/log/fail2ban.log | tail -n 2
2026-11-08 03:13:26,004 fail2ban.actions        [811]: NOTICE  [sshd] Ban 203.0.113.77
2026-11-08 04:13:26,117 fail2ban.actions        [811]: NOTICE  [sshd] Unban 203.0.113.77

Întrebări:
1. Ce adresă a încercat cele mai multe nume de utilizator diferite?
2. Ce adresă s-a autentificat cu succes și cu ce utilizator?
3. Ce adresă a fost blocată și la ce oră (hh:mm)?
4. Ce adresă a făcut mai mult de cinci încercări eșuate, dar nu a fost blocată?
5. De ce nu a fost blocată acea adresă?
   a. Adresa se afla în ignoreip
   b. Încercările au fost la intervale mai mari de zece minute (findtime), deci nu au existat niciodată cinci încercări în zece minute
   c. fail2ban a fost oprit între 03:40 și 06:00
   d. Încercările cu numele admin nu se iau în calcul