Log Files:

• View system logs:

  sudo less /var/log/syslog

• Check authentication logs:

  sudo less /var/log/auth.log

Using Fail2ban:

• Install Fail2ban:

  sudo apt install fail2ban

• Configure /etc/fail2ban/jail.local to ban IPs after multiple failed login attempts.

Audit Tool:

• Use auditd for detailed monitoring.

• Install:

  sudo apt install auditd

• Start the service:

  sudo systemctl start auditd