Open Mischback opened 5 months ago
nginx
does log the actual IP address into a dedicated and short-term log file (max. 24h rotation time? Might even be shorter, like 2h, 6h?).
fail2ban
can work on this log file, doing its magic by banning suspicious activities by IP address.
The short-term access log is then processed to get rid of the actual IP addresses and can then be transferred to the actual server logs.
The idea above assumes that there is an actual requirement to let fail2ban
(or similar tools) work for the website. Is this really the case?
The website mischback.de
is statically generated, pure HTML. There is no dynamic web technology attached. Hopefully this means, there is no attack vector against the website. The only (assumed) attack surface is the webserver itsself.
Possible Attack Vectors:
404
pages. Probably nginx
will handle the expected load.nginx
or the actual server can't handle the load, we're f*****. Nothing to do about this. fail2ban
might help mitigating this, but as there is no business interest in the website, nobody will care anyway.root
access to the actual server
nginx
while serving static content (most likely this is unlikely)nginx
is open source software, so probably fast fixSummary: Storing of the actual IP address is not required. A generalized and anonymized identifier is sufficient for on-page optimization (which has to be implemented during further development). In order to comply with the DSGVO, not storing the IP address seems like the easiest way (see privacy statement of C4).
This will still need more research!
Ok, so the DSGVO / GDPR considers even the users' IP address personal data, which means, that storing and processing this data is regulated (strictly).
On the other hand, protecting my own server, e.g.
fail2ban
, works by analyzing the log files and requires the real IP addresses to work properly.Resources
Related
17