/var/log/auth.log

Jun  3 04:14:01 wopr sshd[1983]: Failed password for root from 203.0.113.23 port 31337 ssh2
Jun  3 04:14:02 wopr sshd[1983]: Failed password for root from 203.0.113.23 port 31337 ssh2
Jun  3 04:14:03 wopr sshd[1983]: Failed password for root from 203.0.113.23 port 31337 ssh2
Jun  3 04:14:03 wopr sshd[1983]: Disconnecting authenticating user root 203.0.113.23: Too many authentication failures [preauth]
Jun  3 04:14:04 wopr fail2ban.actions[666]: NOTICE [sshd] Ban 203.0.113.23 -- see you in 10 years
Jun  3 04:15:12 wopr sshd[2001]: Invalid user admin from 198.51.100.7 port 4444
Jun  3 04:15:13 wopr sshd[2001]: Invalid user administrator from 198.51.100.7 port 4444
Jun  3 04:15:14 wopr sshd[2001]: Invalid user admin123 from 198.51.100.7 port 4444
Jun  3 04:15:15 wopr sshd[2001]: Invalid user pls_let_me_in from 198.51.100.7 port 4444
Jun  3 04:15:16 wopr sshd[2001]: Invalid user ubnt from 198.51.100.7 port 4444 -- wrong house, buddy
Jun  3 04:15:16 wopr fail2ban.actions[666]: NOTICE [sshd] Ban 198.51.100.7
Jun  3 04:20:00 wopr CRON[2600]: pam_unix(cron:session): session opened for user root by (uid=0) -- whistling at 2600 Hz
Jun  3 04:20:01 wopr CRON[2600]: pam_unix(cron:session): session closed for user root
Jun  3 06:58:44 wopr sshd[3001]: Accepted publickey for florian from 192.0.2.10 port 51515 ssh2: ED25519 SHA256:c0d3k1ll3r/hw-k3y
Jun  3 06:58:44 wopr systemd-logind[1]: New session 42 of user florian.
Jun  3 06:58:51 wopr sudo[3010]:  florian : TTY=pts/0 ; PWD=/home/florian ; USER=root ; COMMAND=/usr/bin/make coffee
Jun  3 06:58:51 wopr sudo[3010]: make: *** No rule to make target 'coffee'. Stop.
Jun  3 06:59:02 wopr sudo[3011]:  florian : TTY=pts/0 ; PWD=/home/florian ; USER=root ; COMMAND=/usr/bin/apt install coffee
Jun  3 06:59:03 wopr sudo[3011]: E: Unable to locate package coffee -- tragic
Jun  3 09:00:00 wopr sshd[3333]: Failed password for recruiter from 198.51.100.42 port 9000 ssh2
Jun  3 09:00:00 wopr sshd[3333]:   subject: "quick question" -- auto-banned per policy
Jun  3 09:00:01 wopr fail2ban.actions[666]: NOTICE [recruiters] Ban 198.51.100.42
Jun  3 11:11:11 wopr sshd[4040]: Connection from 203.0.113.99 port 22: client sent "GET / HTTP/1.1" -- this is ssh, friend
Jun  3 13:37:00 wopr sudo[1337]:  florian : TTY=pts/0 ; PWD=/home/florian ; USER=root ; COMMAND=/usr/bin/systemctl restart agents
Jun  3 13:37:05 wopr sudo[1337]: agents.service restarted -- the swarm lives
Jun  3 15:02:47 wopr sshd[5150]: Failed password for joshua from 192.0.2.83 port 1983 ssh2
Jun  3 15:02:51 wopr sshd[5150]: Accepted password for joshua from 192.0.2.83 port 1983 ssh2 -- password: "JOSHUA". of course.
Jun  3 15:02:51 wopr wopr[5151]: GREETINGS PROFESSOR FALKEN.
Jun  3 15:02:58 wopr wopr[5151]: SHALL WE PLAY A GAME?
Jun  3 15:03:10 wopr wopr[5151]: user selected: GLOBAL THERMONUCLEAR WAR
Jun  3 15:03:10 wopr wopr[5151]: DEFCON 1
Jun  3 15:09:44 wopr wopr[5151]: tic-tac-toe self-play: 0 wins, 0 losses, 4096 draws
Jun  3 15:09:45 wopr wopr[5151]: A STRANGE GAME. THE ONLY WINNING MOVE IS NOT TO PLAY.
Jun  3 15:09:45 wopr wopr[5151]: DEFCON 5 -- crisis averted, as usual
Jun  3 23:59:59 wopr sudo[9999]:  florian : TTY=pts/0 ; PWD=/home/florian ; USER=root ; COMMAND=/usr/bin/hackrf_transfer -r /dev/null
Jun  3 23:59:59 wopr sudo[9999]: pam_unix(sudo:session): session opened for user root(uid=0) by florian(uid=1000)
Jun  4 00:00:00 wopr sshd[0]: Accepted curiosity for you from your-browser port 443
Jun  4 00:00:00 wopr sshd[0]: welcome. read anything good? (the IPs above are RFC 5737 documentation ranges. no one was harmed.)

Status
|- Number of jail:      3
`- Jail list:   sshd, wopr, recruiters