Implementasi Fail2Ban dan ELK Stack untuk Mitigasi Serangan Brute Force pada REST API Login E-Learning Berbasis Docker

Abstract

The increasing adoption of digital learning systems (E-Learning) has raised the need for security mechanisms capable of protecting authentication services from cyber threats. One of the most common threats is a brute force attack, which exploits repeated login attempts using automated username and password combinations. This study aims to implement Fail2Ban and the ELK Stack to mitigate brute force attacks on a Docker-based E-Learning Login REST API. The research employed an experimental method by developing a containerized environment consisting of an E-Learning Login REST API, Fail2Ban, Filebeat, Logstash, Elasticsearch, Kibana, and attacker containers. Brute force attack simulations were conducted using Hydra against the authentication service. Data were collected from authentication logs, Fail2Ban logs, and security monitoring results visualized through Kibana dashboards. The results show that Fail2Ban successfully detected 180 failed login attempts originating from six attacker IP addresses and automatically blocked all attacker IPs, achieving a mitigation success rate of 100%. The average mitigation response time ranged from 0.314 to 0.443 seconds with a bantime of 500 seconds. Furthermore, the ELK Stack successfully provided real-time visualization of failed login activities, attacker IP addresses, and blocking actions. The findings indicate that the integration of Fail2Ban and the ELK Stack in a Docker environment is effective in improving the security of the E-Learning Login REST API against brute force attacks through centralized detection, mitigation, and security monitoring mechanisms.