駭客任務，黑與白對抗

網站建立起來，架好網頁，彷彿在花園裡種滿了花花草草，一群蜜蜂蝴蝶(駭客)，就聞著味道蜂擁而來了. 來採蜜可以，來偷家不行！

架構

安裝fail2ban做稽核和攔截

先說黑白對抗結果，再說對抗的過程

結果 :

rich@rich-vb-u24:~/pure-php-app$ sudo fail2ban-client status nginx-4xx
[sudo] rich 的密碼： 
Status for the jail: nginx-4xx
|- Filter
|  |- Currently failed:	2
|  |- Total failed:	911
|  `- File list:	/home/rich/pure-php-app/nginx/logs/access.log
`- Actions
   |- Currently banned:	123
   |- Total banned:	123
   `- Banned IP list:	106.75.64.235 123.58.209.194 130.12.180.77 135.125.1.158 147.45.41.137.172.108 159.89.207.161 164.52.0.92 164.52.24.179 165.154.202.244 167.94.146.48 178.62.250.64 .179.136 190.167.112.113 195.178.110.137 20.100.191.218 20.100.198.199 20.215.186.32 20.52.1596.180.246.32 27.100.64.228 3.129.187.38 34.140.121.115 34.22.126.244 34.76.153.167 4.223.140.1.193.193 45.156.128.10 45.156.128.13 45.156.128.14 45.156.128.15 47.79.13.251 47.82.11.150 47. 51.103.131.31 51.158.248.246 52.159.244.95 62.146.235.70 66.132.172.131 66.132.195.122 66.132 72.146.33.199 80.94.95.211 66.132.195.99 199.45.155.70 150.107.38.206 20.203.208.53 207.154.2 151.243.11.230 74.249.224.76 74.248.97.169 87.236.176.19 171.67.71.223 18.116.101.220 138.19735.240.29.70 34.77.108.46 160.119.76.5 103.252.221.157 4.225.166.176 164.52.24.185 66.132.186..209.227.105 138.68.72.133 206.81.24.206 165.22.233.81 87.236.176.78 172.213.208.13 112.102.1972.161.1.105 159.65.148.75 94.96.184.195 156.236.110.176 103.55.90.11 181.214.140.97 103.199.25.122.122.122 61.129.155.200 66.132.195.113 66.132.172.130 202.125.94.185 85.215.122.94 103.63 172.213.227.73 159.223.132.86 176.32.193.16 5.101.64.6 20.215.70.187 3.130.168.2 111.231.101.210.142.177 4.223.73.90 20.203.165.80 66.132.172.203 66.132.172.214 45.148.10.125 34.156.150.1.151.254 34.34.141.47 138.197.15.182 165.154.172.115 205.169.39.5 20.250.24.46 172.232.232.48 9.125.91 20.100.172.153 165.154.163.173 165.154.162.82

細節 :

2026-08-10 fail2ban 最新攔截名單名單 (我把名單投餵給AI, 讓AI分析這些駭客名單)

過程 :

簡單說, 建立4道防線, 期間踩了一個主機跟docker之間防火牆網路轉發的坑 (這次網站的建立的方式採用docker容器堆積木的方式)

防禦層級	負責角色	實際運作機制
第一道防線
(基礎設施層)	Fail2ban + Docker	獵殺並封鎖惡意連續踩點、亂掃 8080/443 的外國 IP，連 Nginx 的門都進不來。
第二道防線
(網頁伺服器層)	Nginx (`longfutemple.conf`)	拒絕任何外部訪客讀取 `.user.ini` 或任何點開頭的隱藏檔案，直接給予 403 Forbidden，保護結構隱私。
第三道防線
(應用程式 WAF 層)	Wordfence (`wordfence-waf.php`)	透過內部引導機制保護 WordPress 本體，過濾惡意的 POST 請求、防範未知漏洞漏洞。
底層安全鎖
(執行環境層)	PHP `security.ini`	限制 `open_basedir` 權限，確保萬一外掛有漏洞被控制，駭客也無法跨出目錄偷看系統密碼。