# Näidisfail ülesande Z5.3 juurde (kursus VPS ja Linuxi serveri haldus)
# Server "web1" (Debian 13), sisselogimine ainult võtmetega, fail2ban seadetega maxretry = 5, findtime = 10m, bantime = 1h.
# Käsu väljund: sudo journalctl -u ssh --since "2026-11-08 03:00" --until "2026-11-08 09:00"
# ja seejärel: sudo fail2ban-client status sshd (kell 09:00). Kõik aadressid on dokumentatsiooniaadressid.

nov 08 03:12:01 web1 sshd-session[1201]: Invalid user admin from 203.0.113.77 port 40112
nov 08 03:12:01 web1 sshd-session[1201]: Connection closed by invalid user admin 203.0.113.77 port 40112 [preauth]
nov 08 03:12:19 web1 sshd-session[1204]: Invalid user oracle from 203.0.113.77 port 40398
nov 08 03:12:19 web1 sshd-session[1204]: Connection closed by invalid user oracle 203.0.113.77 port 40398 [preauth]
nov 08 03:12:40 web1 sshd-session[1210]: Invalid user test from 203.0.113.77 port 40731
nov 08 03:12:40 web1 sshd-session[1210]: Connection closed by invalid user test 203.0.113.77 port 40731 [preauth]
nov 08 03:13:02 web1 sshd-session[1215]: Invalid user ubuntu from 203.0.113.77 port 41020
nov 08 03:13:02 web1 sshd-session[1215]: Connection closed by invalid user ubuntu 203.0.113.77 port 41020 [preauth]
nov 08 03:13:25 web1 sshd-session[1221]: Invalid user postgres from 203.0.113.77 port 41377
nov 08 03:13:25 web1 sshd-session[1221]: Connection closed by invalid user postgres 203.0.113.77 port 41377 [preauth]
nov 08 03:40:12 web1 sshd-session[1302]: Invalid user admin from 198.51.100.140 port 52210
nov 08 03:40:12 web1 sshd-session[1302]: Connection closed by invalid user admin 198.51.100.140 port 52210 [preauth]
nov 08 04:05:44 web1 sshd-session[1350]: Invalid user admin from 198.51.100.140 port 52918
nov 08 04:05:44 web1 sshd-session[1350]: Connection closed by invalid user admin 198.51.100.140 port 52918 [preauth]
nov 08 04:31:09 web1 sshd-session[1399]: Invalid user admin from 198.51.100.140 port 53604
nov 08 04:31:09 web1 sshd-session[1399]: Connection closed by invalid user admin 198.51.100.140 port 53604 [preauth]
nov 08 04:56:30 web1 sshd-session[1441]: Invalid user admin from 198.51.100.140 port 54280
nov 08 04:56:30 web1 sshd-session[1441]: Connection closed by invalid user admin 198.51.100.140 port 54280 [preauth]
nov 08 05:21:58 web1 sshd-session[1490]: Invalid user admin from 198.51.100.140 port 55007
nov 08 05:21:58 web1 sshd-session[1490]: Connection closed by invalid user admin 198.51.100.140 port 55007 [preauth]
nov 08 05:47:21 web1 sshd-session[1532]: Invalid user admin from 198.51.100.140 port 55689
nov 08 05:47:21 web1 sshd-session[1532]: Connection closed by invalid user admin 198.51.100.140 port 55689 [preauth]
nov 08 06:58:03 web1 sshd-session[1604]: Connection closed by authenticating user root 198.51.100.7 port 61002 [preauth]
nov 08 08:31:47 web1 sshd-session[1688]: Accepted publickey for anna from 192.0.2.55 port 50122 ssh2: ED25519 SHA256:q3Vb0Yx8cXk2pR7mW1sTnH4dJ9eLfA6uZ5oGiC2vBQs
nov 08 08:31:47 web1 sshd-session[1688]: pam_unix(sshd:session): session opened for user anna(uid=1000) by anna(uid=0)

anna@web1:~$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     11
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 0
   |- Total banned:     1
   `- Banned IP list:

anna@web1:~$ sudo grep -E "Ban|Unban" /var/log/fail2ban.log | tail -n 2
2026-11-08 03:13:26,004 fail2ban.actions        [811]: NOTICE  [sshd] Ban 203.0.113.77
2026-11-08 04:13:26,117 fail2ban.actions        [811]: NOTICE  [sshd] Unban 203.0.113.77

Küsimused:
1. Milline aadress proovis kõige rohkem erinevaid kasutajanimesid?
2. Milline aadress logis edukalt sisse ja millise kasutajana?
3. Milline aadress blokeeriti ja mis kell (hh:mm)?
4. Milline aadress tegi üle viie ebaõnnestunud katse, kuid ei saanud blokeeringut?
5. Miks seda aadressi ei blokeeritud?
   a. Aadress oli kirjas ignoreip all
   b. Katsete vahe oli üle kümne minuti (findtime), nii et kümne minuti jooksul ei olnud kunagi viit katset
   c. fail2ban oli välja lülitatud kella 03:40 ja 06:00 vahel
   d. Katsed nimega admin ei lähe arvesse