็†ฑ้–€ๅˆ†้กž
 ่ผ‰ๅ…ฅไธญ…
็›ฎ้Œ„

๐Ÿ“Š Linux Log ็›ฃๆŽง่‡ชๅ‹•ๅŒ–：ๆ•ดๅˆ GoAccess、Systemd ่ˆ‡ Fail2Ban ๅ ฑ่กจๅˆ†ๆž

wwfandy ่จˆ็ฎ—ไธญ…

    ๐Ÿ“Š Linux Log ็›ฃๆŽง่‡ชๅ‹•ๅŒ–：ๆ•ดๅˆ GoAccess、Systemd ่ˆ‡ Fail2Ban ๅ ฑ่กจๅˆ†ๆž

    ๅœจ Linux ็ณป็ตฑ็ถญ้‹ไธญ，Log ๅˆ†ๆžๅพ€ๅพ€ๆฑบๅฎšไบ†ๅ•้กŒๆŽ’ๆŸฅๆ•ˆ็Ž‡。 ๆœฌ็ฏ‡ๆ•™ไฝ ๅฆ‚ไฝ•็ตๅˆ GoAccess、Systemd ่ˆ‡ Fail2Ban，ๆ‰“้€ ไธ€ๅฅ—่‡ชๅ‹•ๅŒ–ๅฎ‰ๅ…จ็›ฃๆŽงๅ ฑ่กจ， ๅณๆ™‚่ง€ๅฏŸ้€ฃ็ทš่กŒ็‚บ、ๅฐ้Ž–ๆƒกๆ„ IP ไธฆ็”Ÿๆˆๅฏ่ฆ–ๅŒ–ๅ„€่กจๆฟ。

    ไธ€、็’ฐๅขƒ่ˆ‡ๅฎ‰่ฃ

    # ๅฎ‰่ฃ GoAccess
sudo apt install goaccess -y

# ๅฎ‰่ฃ Fail2Ban
sudo apt install fail2ban -y

    ไบŒ、ๆ•ดๅˆ systemd-journal ่ˆ‡ GoAccess

    ไฝฟ็”จ journalctl ๅŒฏๅ‡บๆ—ฅ่ชŒไธฆ่ฎ“ GoAccess ๅณๆ™‚ๅˆ†ๆž：

    journalctl -u nginx.service -f | goaccess -o /var/www/html/report.html --log-format=COMBINED

    ไธ‰、็ตๅˆ Fail2Ban ่ˆ‡่‡ชๅ‹•ๅŒ–ๅฐ้Ž–

    ๅปบ็ซ‹่‡ชๅ‹•ๅฐ้Ž–่ˆ‡้€š็ŸฅๆฉŸๅˆถ：

    [sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5

    ๅ››、่‡ชๅ‹•ๅŒ–ๅ ฑ่กจๆŽ’็จ‹

    ้€้Ž systemd timer ๅฎšๆœŸ่ผธๅ‡บ GoAccess ๅ ฑ่กจ：

    # /etc/systemd/system/goaccess-report.service
[Service]
Type=oneshot
ExecStart=/usr/bin/goaccess /var/log/nginx/access.log -o /var/www/html/report.html --log-format=COMBINED

# /etc/systemd/system/goaccess-report.timer
[Timer]
OnCalendar=hourly
Persistent=true
WantedBy=timers.target

    ๐Ÿ“˜ ็ต่ชž

    ็ตๅˆ GoAccess、systemd ่ˆ‡ Fail2Ban，ไธๅƒ…่ƒฝ่‡ชๅ‹•ๅŒ–ๅฎ‰ๅ…จ็›ฃๆŽง， ๆ›ด่ƒฝๅฐ‡็ณป็ตฑ็ถญ้‹่ฝ‰็‚บๆ•ธๆ“šๅŒ–่ˆ‡ๅฏ่ฆ–ๅŒ–็ฎก็†， ๆ˜ฏไธญๅฐไผๆฅญ่ˆ‡ๅฏฆ้ฉ—ๅฎค็’ฐๅขƒไธญๆœ€ๅ…ทๆˆๆœฌๆ•ˆ็›Š็š„ๆ–นๆกˆไน‹ไธ€。

    ๐Ÿ”— ๅปถไผธ้–ฑ่ฎ€

    — WWFandy・็ณป็ตฑ่ˆ‡็ถฒ่ทฏ็ญ†่จ˜

    ๆจ™็ฑค：
    ๐Ÿ”— ๅˆ†ไบซ้€™็ฏ‡ LINE Facebook X

    ๆฒ’ๆœ‰็•™่จ€:

    ๅผต่ฒผ็•™่จ€

    ๅญ—็ดš