How to see auth.log for intruders and bots:
type journalctl first
then install rsyslog
read /var/log/secure for ALL traffic
sudo tail -20 /var/log/secure (for the most recent entries)
Mastering Fail2Ban on your server:
https://www.veeble.com/kb/mastering-fail2ban-defense-for-linux-server/
Note: Don’t put all the sshd details in the first commented section at the top. Where? Look at [sshd] fail2ban config.txt in Linux Storage > 0-Hosting Files.
You can also receive emails about banned IPs but you must have an MTA(Mail Transfer Agent) installed on the server to do this. You can also adjust ban policies if repeated attacks from certain IPs become a problem:
bantime = 86400
findtime = 900
maxretry = 3
Securing Caddy server with Fail2Ban:
Inside /etc/fail2ban there should be a file called jail.conf and a directory called filter.d. First we’ll create a filters file, in which we can define a matching pattern which reads our common log format produced by your customized Caddy setup. Run vim filter.d/caddy-access.conf and enter the following:
[Definition]
failregex = ^
The failregex value is what interests us. I know, regex is fucking disgusting to most people1, but let me try and make sense of it to you
First up, we wrap the pattern with starting and ending markers ^...$. This way we enforce that we match single log lines only.
The <HOST> thingy is a Fail2Ban specific thingy, it is a placeholder for a more complex sub-pattern, and I don’t know what it exactlycontains. The reason of this sub-pattern is to match the client IP.
.* bits mean “match anything between the lengths or zero and infinity, or until the next pattern piece matches something else”. The (GET|POST|OPTION) group matches the request method which the client