Security Hardening: Proaktive Kontosperren, Fail2Ban-Integration, SecurityLogger, Alerting und API-Schutz

sql/migrations/018_security_lockout_and_audit.sql

@@ -0,0 +1,29 @@
+-- Migration 018: Proaktive Kontosperren, Sicherheits-Audit und zentrales Rate-Limiting
+--
+-- Additive Migration. Der Migrator toleriert 1050/1060/1061/1062/1091 ("existiert bereits").
+
+-- ---------------------------------------------------------------------------
+-- 1. Kontosperren in dc_users
+-- ---------------------------------------------------------------------------
+-- failed_login_count: Zaehlt konsekutive Fehlversuche fuer dieses Konto.
+-- locked_until: Zeitpunkt (UTC), bis zu dem das Konto gesperrt ist.
+ALTER TABLE dc_users
+  ADD COLUMN failed_login_count INT NOT NULL DEFAULT 0 AFTER disabled;
+
+ALTER TABLE dc_users
+  ADD COLUMN locked_until DATETIME NULL AFTER failed_login_count;
+
+ALTER TABLE dc_users
+  ADD KEY ix_users_locked (locked_until);
+
+-- ---------------------------------------------------------------------------
+-- 2. Zentrales Rate-Limiting fuer alle API-Endpunkte und Auth-Wege
+-- ---------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS dc_rate_limits (
+  ip            VARBINARY(16) NOT NULL,
+  bucket        VARCHAR(64)   NOT NULL DEFAULT 'default',
+  window_start  DATETIME      NOT NULL,
+  request_count INT           NOT NULL DEFAULT 1,
+  PRIMARY KEY (ip, bucket, window_start),
+  KEY ix_rate_limits_window (window_start)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

sql/schema.sql

@@ -14,11 +14,14 @@ CREATE TABLE IF NOT EXISTS dc_users (
   role ENUM('admin','installer') NOT NULL DEFAULT 'admin',
   last_login_at DATETIME NULL,
   disabled TINYINT(1) NOT NULL DEFAULT 0,
+  failed_login_count INT NOT NULL DEFAULT 0,
+  locked_until DATETIME NULL,
   -- Vorgesehen, aber noch nicht ausgewertet: es gibt bislang keine
   -- TOTP-Pruefung im Anmeldeweg.
   totp_secret VARCHAR(64) NULL,
   created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  KEY ix_users_role (role)
+  KEY ix_users_role (role),
+  KEY ix_users_locked (locked_until)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
 CREATE TABLE IF NOT EXISTS dc_settings (
@@ -26,6 +29,15 @@ CREATE TABLE IF NOT EXISTS dc_settings (
   svalue TEXT NOT NULL
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
+CREATE TABLE IF NOT EXISTS dc_rate_limits (
+  ip            VARBINARY(16) NOT NULL,
+  bucket        VARCHAR(64)   NOT NULL DEFAULT 'default',
+  window_start  DATETIME      NOT NULL,
+  request_count INT           NOT NULL DEFAULT 1,
+  PRIMARY KEY (ip, bucket, window_start),
+  KEY ix_rate_limits_window (window_start)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
 -- Core Projects Table (Shared across Lizenzen, Watchdog, UpdateService)
 CREATE TABLE IF NOT EXISTS dc_projects (
   id INT AUTO_INCREMENT PRIMARY KEY,