Security Hardening: Proaktive Kontosperren, Fail2Ban-Integration, SecurityLogger, Alerting und API-Schutz

2026-09-08 11:45:04 +02:00
parent 087f4392a9
commit edea46e342
17 changed files with 927 additions and 169 deletions
@@ -0,0 +1,29 @@
+-- Migration 018: Proaktive Kontosperren, Sicherheits-Audit und zentrales Rate-Limiting
+--
+-- Additive Migration. Der Migrator toleriert 1050/1060/1061/1062/1091 ("existiert bereits").
+
+-- ---------------------------------------------------------------------------
+-- 1. Kontosperren in dc_users
+-- ---------------------------------------------------------------------------
+-- failed_login_count: Zaehlt konsekutive Fehlversuche fuer dieses Konto.
+-- locked_until: Zeitpunkt (UTC), bis zu dem das Konto gesperrt ist.
+ALTER TABLE dc_users
+  ADD COLUMN failed_login_count INT NOT NULL DEFAULT 0 AFTER disabled;
+
+ALTER TABLE dc_users
+  ADD COLUMN locked_until DATETIME NULL AFTER failed_login_count;
+
+ALTER TABLE dc_users
+  ADD KEY ix_users_locked (locked_until);
+
+-- ---------------------------------------------------------------------------
+-- 2. Zentrales Rate-Limiting fuer alle API-Endpunkte und Auth-Wege
+-- ---------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS dc_rate_limits (
+  ip            VARBINARY(16) NOT NULL,
+  bucket        VARCHAR(64)   NOT NULL DEFAULT 'default',
+  window_start  DATETIME      NOT NULL,
+  request_count INT           NOT NULL DEFAULT 1,
+  PRIMARY KEY (ip, bucket, window_start),
+  KEY ix_rate_limits_window (window_start)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;