{"id":28971,"date":"2026-01-30T03:52:55","date_gmt":"2026-01-30T03:52:55","guid":{"rendered":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/?p=28971"},"modified":"2026-02-01T07:49:45","modified_gmt":"2026-02-01T07:49:45","slug":"%e6%97%a9%e9%80%9f%e4%b8%8d%e6%ad%a3%e3%82%a2%e3%82%af%e3%82%bb%e3%82%b9","status":"publish","type":"post","link":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/?p=28971","title":{"rendered":"\u65e9\u901f\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9"},"content":{"rendered":"\n

昨日の夜9時頃でしたか，何気なくサーバーのコンソールからtopコマンドを実行してみると，上から下までapache2のプロセスが並びました．これは尋常ではないことが起きていると，\/var\/log\/apache2\/access.logを見てみると，ものすごい勢いで\/wp-login.phpにアクセスがかけられています．間違いなく辞書を使ったbrute-forceアタックです．<\/p>\n\n\n\n

その時はIPアドレスをプロバイダーのルーターに登録して止めましたが，次に記すセキュリティーアプリのインストール中に，5万件のアクセスだったことが解りました．<\/p>\n\n\n\n

そういう訳で今朝はGeminiにDebianでiptablesを使ったブロックの仕方を教わっているうちに，WordPressのデフォルトのログインを止めるpluginのインストールと，Fail2Banというソフトのインストールを勧められました．<\/p>\n\n\n\n

WordPressのpluginはWPS Hide Login<\/a>というもので，ログインのURL内のパスを任意の文字列に設定できます．そこで迷うことなくUUIDにしました．それでwp-login.phpを指定してきたアクセスは404 not foundになります．これはこれでめでたしめでたしです．<\/p>\n\n\n\n

次のFail2Banは，ログを解析して，怪しいアクセスをしてきたところからのIPを無視するように設定するソフトです．設定が複雑なので，Geminiと相談しながらやってみました．その過程で昨夜のログを分析させたら5万件もの “不正アクセス” が検知できたわけです．これは，以前のRaspberry Pi 4 Model B (RPi4)ではそこまで行かなかったと思います．RPi4より体感や簡単な計測で4〜8倍速いRaspberry Pi 5 (RPi5)ならではの被害です．<\/p>\n\n\n\n

sendmailもこれを使って防御しつつIPv4のポートも開こうかななどと少し考えています．<\/p>\n","protected":false},"excerpt":{"rendered":"

\u6628\u65e5\u306e\u591c9\u6642\u9803\u3067\u3057\u305f\u304b\uff0c\u4f55\u6c17\u306a\u304f\u30b5\u30fc\u30d0\u30fc\u306e\u30b3\u30f3\u30bd\u30fc\u30eb\u304b\u3089top\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066\u307f\u308b\u3068\uff0c\u4e0a\u304b\u3089\u4e0b\u307e\u3067apache2\u306e\u30d7\u30ed\u30bb\u30b9\u304c\u4e26\u3073\u307e\u3057\u305f\uff0e\u3053\u308c\u306f\u5c0b\u5e38\u3067\u306f\u306a\u3044\u3053\u3068\u304c\u8d77\u304d\u3066\u3044\u308b\u3068\uff0c\/var\/log\/apache2\/access.log\u3092\u898b\u3066\u307f\u308b\u3068\uff0c\u3082\u306e\u3059\u3054\u3044\u52e2\u3044\u3067\/wp-login.php\u306b\u30a2\u30af\u30bb\u30b9\u304c\u304b\u3051\u3089\u308c\u3066\u3044\u307e\u3059\uff0e\u9593\u9055\u3044\u306a\u304f\u8f9e\u66f8\u3092\u4f7f\u3063\u305fbrute-force\u30a2\u30bf\u30c3\u30af\u3067\u3059\uff0e \u305d\u306e\u6642\u306fIP\u30a2\u30c9\u30ec\u30b9\u3092\u30d7\u30ed\u30d0\u30a4\u30c0\u30fc\u306e\u30eb\u30fc\u30bf\u30fc\u306b\u767b\u9332\u3057\u3066\u6b62\u3081\u307e\u3057\u305f\u304c\uff0c\u6b21\u306b\u8a18\u3059\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fc\u30a2\u30d7\u30ea\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u4e2d\u306b\uff0c5\u4e07\u4ef6\u306e\u30a2\u30af\u30bb\u30b9\u3060\u3063\u305f\u3053\u3068\u304c\u89e3\u308a\u307e\u3057\u305f\uff0e \u305d\u3046\u3044\u3046\u8a33\u3067\u4eca\u671d\u306fGemini\u306bDebian\u3067iptables\u3092\u4f7f\u3063\u305f\u30d6\u30ed\u30c3\u30af\u306e\u4ed5\u65b9\u3092\u6559\u308f\u3063\u3066\u3044\u308b\u3046\u3061\u306b\uff0cWordPress\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u30ed\u30b0\u30a4\u30f3\u3092\u6b62\u3081\u308bplugin\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3068\uff0cFail2Ban\u3068\u3044\u3046\u30bd\u30d5\u30c8\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3092\u52e7\u3081\u3089\u308c\u307e\u3057\u305f\uff0e WordPress\u306eplugin\u306fWPS Hide Login\u3068\u3044\u3046\u3082\u306e\u3067\uff0c\u30ed\u30b0\u30a4\u30f3\u306eURL\u5185\u306e\u30d1\u30b9\u3092\u4efb\u610f\u306e\u6587\u5b57\u5217\u306b\u8a2d\u5b9a\u3067\u304d\u307e\u3059\uff0e\u305d\u3053\u3067\u8ff7\u3046\u3053\u3068\u306a\u304fUUID\u306b\u3057\u307e\u3057\u305f\uff0e\u305d\u308c\u3067wp-login.php\u3092\u6307\u5b9a\u3057\u3066\u304d\u305f\u30a2\u30af\u30bb\u30b9\u306f404 not found\u306b\u306a\u308a\u307e\u3059\uff0e\u3053\u308c\u306f\u3053\u308c\u3067\u3081\u3067\u305f\u3057\u3081\u3067\u305f\u3057\u3067\u3059\uff0e \u6b21\u306eFail2Ban\u306f\uff0c\u30ed\u30b0\u3092\u89e3\u6790\u3057\u3066\uff0c\u602a\u3057\u3044\u30a2\u30af\u30bb\u30b9\u3092\u3057\u3066\u304d\u305f\u3068\u3053\u308d\u304b\u3089\u306eIP\u3092\u7121\u8996\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3059\u308b\u30bd\u30d5\u30c8\u3067\u3059\uff0e\u8a2d\u5b9a\u304c\u8907\u96d1\u306a\u306e\u3067\uff0cGemini\u3068\u76f8\u8ac7\u3057\u306a\u304c\u3089\u3084\u3063\u3066\u307f\u307e\u3057\u305f\uff0e\u305d\u306e\u904e\u7a0b\u3067\u6628\u591c\u306e\u30ed\u30b0\u3092\u5206\u6790\u3055\u305b\u305f\u30895\u4e07\u4ef6\u3082\u306e “\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9” \u304c\u691c\u77e5\u3067\u304d\u305f\u308f\u3051\u3067\u3059\uff0e\u3053\u308c\u306f\uff0c\u4ee5\u524d\u306eRaspberry Pi 4 Model B (RPi4)\u3067\u306f\u305d\u3053\u307e\u3067\u884c\u304b\u306a\u304b\u3063\u305f\u3068\u601d\u3044\u307e\u3059\uff0eRPi4\u3088\u308a\u4f53\u611f\u3084\u7c21\u5358\u306a\u8a08\u6e2c\u30674\u301c8\u500d\u901f\u3044Raspberry Pi 5 (RPi5)\u306a\u3089\u3067\u306f\u306e\u88ab\u5bb3\u3067\u3059\uff0e sendmail\u3082\u3053\u308c\u3092\u4f7f\u3063\u3066\u9632\u5fa1\u3057\u3064\u3064IPv4\u306e\u30dd\u30fc\u30c8\u3082\u958b\u3053\u3046\u304b\u306a\u306a\u3069\u3068\u5c11\u3057\u8003\u3048\u3066\u3044\u307e\u3059\uff0e<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_daextam_enable_autolinks":"1","footnotes":"[]"},"categories":[9,6,641,20,8,10,27,4],"tags":[],"class_list":["post-28971","post","type-post","status-publish","format-standard","hentry","category-aarch64","category-debian","category-fail2ban","category-ipv6","category-linux","category-network","category-rasapberry-pi","category-wordpress"],"publishpress_future_action":{"enabled":false,"date":"2026-05-07 14:22:48","action":"change-status","newStatus":"draft","terms":[],"taxonomy":"category","extraData":[]},"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/posts\/28971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=28971"}],"version-history":[{"count":1,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/posts\/28971\/revisions"}],"predecessor-version":[{"id":28972,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=\/wp\/v2\/posts\/28971\/revisions\/28972"}],"wp:attachment":[{"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/je1sgh.mydns.jp\/je1sghblog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}