# Ficheiro de exemplo para o exercício Z5.3 (curso VPS e administração de servidores Linux)
# Servidor "web1" (Debian 13), início de sessão apenas com chaves, fail2ban com maxretry = 5, findtime = 10m, bantime = 1h.
# Resultado de: sudo journalctl -u ssh --since "2026-11-08 03:00" --until "2026-11-08 09:00"
# e depois: sudo fail2ban-client status sshd (às 09:00). Todos os endereços são endereços de documentação.

nov 08 03:12:01 web1 sshd-session[1201]: Invalid user admin from 203.0.113.77 port 40112
nov 08 03:12:01 web1 sshd-session[1201]: Connection closed by invalid user admin 203.0.113.77 port 40112 [preauth]
nov 08 03:12:19 web1 sshd-session[1204]: Invalid user oracle from 203.0.113.77 port 40398
nov 08 03:12:19 web1 sshd-session[1204]: Connection closed by invalid user oracle 203.0.113.77 port 40398 [preauth]
nov 08 03:12:40 web1 sshd-session[1210]: Invalid user test from 203.0.113.77 port 40731
nov 08 03:12:40 web1 sshd-session[1210]: Connection closed by invalid user test 203.0.113.77 port 40731 [preauth]
nov 08 03:13:02 web1 sshd-session[1215]: Invalid user ubuntu from 203.0.113.77 port 41020
nov 08 03:13:02 web1 sshd-session[1215]: Connection closed by invalid user ubuntu 203.0.113.77 port 41020 [preauth]
nov 08 03:13:25 web1 sshd-session[1221]: Invalid user postgres from 203.0.113.77 port 41377
nov 08 03:13:25 web1 sshd-session[1221]: Connection closed by invalid user postgres 203.0.113.77 port 41377 [preauth]
nov 08 03:40:12 web1 sshd-session[1302]: Invalid user admin from 198.51.100.140 port 52210
nov 08 03:40:12 web1 sshd-session[1302]: Connection closed by invalid user admin 198.51.100.140 port 52210 [preauth]
nov 08 04:05:44 web1 sshd-session[1350]: Invalid user admin from 198.51.100.140 port 52918
nov 08 04:05:44 web1 sshd-session[1350]: Connection closed by invalid user admin 198.51.100.140 port 52918 [preauth]
nov 08 04:31:09 web1 sshd-session[1399]: Invalid user admin from 198.51.100.140 port 53604
nov 08 04:31:09 web1 sshd-session[1399]: Connection closed by invalid user admin 198.51.100.140 port 53604 [preauth]
nov 08 04:56:30 web1 sshd-session[1441]: Invalid user admin from 198.51.100.140 port 54280
nov 08 04:56:30 web1 sshd-session[1441]: Connection closed by invalid user admin 198.51.100.140 port 54280 [preauth]
nov 08 05:21:58 web1 sshd-session[1490]: Invalid user admin from 198.51.100.140 port 55007
nov 08 05:21:58 web1 sshd-session[1490]: Connection closed by invalid user admin 198.51.100.140 port 55007 [preauth]
nov 08 05:47:21 web1 sshd-session[1532]: Invalid user admin from 198.51.100.140 port 55689
nov 08 05:47:21 web1 sshd-session[1532]: Connection closed by invalid user admin 198.51.100.140 port 55689 [preauth]
nov 08 06:58:03 web1 sshd-session[1604]: Connection closed by authenticating user root 198.51.100.7 port 61002 [preauth]
nov 08 08:31:47 web1 sshd-session[1688]: Accepted publickey for anna from 192.0.2.55 port 50122 ssh2: ED25519 SHA256:q3Vb0Yx8cXk2pR7mW1sTnH4dJ9eLfA6uZ5oGiC2vBQs
nov 08 08:31:47 web1 sshd-session[1688]: pam_unix(sshd:session): session opened for user anna(uid=1000) by anna(uid=0)

anna@web1:~$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     11
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 0
   |- Total banned:     1
   `- Banned IP list:

anna@web1:~$ sudo grep -E "Ban|Unban" /var/log/fail2ban.log | tail -n 2
2026-11-08 03:13:26,004 fail2ban.actions        [811]: NOTICE  [sshd] Ban 203.0.113.77
2026-11-08 04:13:26,117 fail2ban.actions        [811]: NOTICE  [sshd] Unban 203.0.113.77

Perguntas:
1. Que endereço tentou o maior número de nomes de utilizador diferentes?
2. Que endereço iniciou sessão com sucesso, e com que utilizador?
3. Que endereço foi banido, e a que horas (hh:mm)?
4. Que endereço fez mais de cinco tentativas falhadas mas não foi banido?
5. Porque é que esse endereço não foi banido?
   a. O endereço constava de ignoreip
   b. As tentativas estavam separadas por mais de dez minutos (findtime), pelo que nunca houve cinco em dez minutos
   c. O fail2ban esteve desligado entre as 03:40 e as 06:00
   d. As tentativas com o nome admin não contam