#!/usr/bin/env bash # audit_dominanostra_web.sh — eseguito da HERMES (radiosrv) via SSH read-only # Conta gli IP che attaccano wp-login/xmlrpc su dominanostra.it e i ban fail2ban. # NESSUNA modifica sul server remoto. Richiede che lo script # fix_dominanostra_sudoers_apache.sh sia stato lanciato (lettura log Apache). set -u HOST="217.182.171.171"; PORT="22672"; USER="monnis"; KEY="$HOME/.ssh/id_ed25519_dominanostra" DATE=$(date +%Y-%m-%d) SHARE="/var/www/dam.stefanomonni.it/share" OUT="$SHARE/audit_dominanostra_web_$DATE.html" run() { ssh -n -i "$KEY" -p "$PORT" -o StrictHostKeyChecking=no -o ConnectTimeout=10 -o BatchMode=yes "$USER@$HOST" "$1" 2>&1; } # 1) Accessi wp-login / xmlrpc (se log leggibili) WPCOUNT=$(run 'sudo -n grep -c -E "wp-login.php|xmlrpc.php" /var/log/apache2/access.log 2>/dev/null || echo NEGATO') TOP_IP=$(run 'sudo -n grep -E "wp-login.php|xmlrpc.php" /var/log/apache2/access.log 2>/dev/null | grep -oE "([0-9]{1,3}\.){3}[0-9]{1,3}" | sort | uniq -c | sort -rn | head -10') # 2) Stato jail fail2ban rilevanti J_WP=$(run 'sudo -n /usr/bin/fail2ban-client status wordpress 2>/dev/null | grep -iE "Currently banned|Total banned" | tr "\n" " "') J_DOV=$(run 'sudo -n /usr/bin/fail2ban-client status dovecot 2>/dev/null | grep -iE "Currently banned|Total banned" | tr "\n" " "') J_SSH=$(run 'sudo -n /usr/bin/fail2ban-client status sshd 2>/dev/null | grep -iE "Currently banned|Total banned" | tr "\n" " "') cat > /tmp/audit_dominanostra_web_$DATE.html < Audit Web DOMINANOSTRA — $DATE

Audit Web — DOMINANOSTRA

$DATE · read-only · server $HOST

Accessi WordPress (wp-login / xmlrpc)

Totale richieste wp-login/xmlrpc (log corrente)	$WPCOUNT

Top IP attaccanti

${TOP_IP:-nessun dato (log non leggibile o nessun attacco)}

Stato fail2ban

Jail	Banned (correnti / totali)
wordpress	${J_WP:-n/d}
dovecot	${J_DOV:-n/d}
sshd	${J_SSH:-n/d}

EOF sudo -n cp /tmp/audit_dominanostra_web_$DATE.html "$OUT" && sudo -n chown www-data:www-data "$OUT" && sudo -n chmod 644 "$OUT" rm -f /tmp/audit_dominanostra_web_$DATE.html echo "Report: https://dam.stefanomonni.it/share/audit_dominanostra_web_$DATE.html"