locating-ssh-hackers | DIY project to show failed ssh login attempts

The setup of influxdb is pretty straignt forward: we will not expose influxdb to the network (because we don't need this in this use-case). We will be using helm as the package manager to do the install, based on a slightly modified values.yml. The influxdb user is admin and you can retrieve the auto-generated password with: kubectl -n influxdb get secret influxdb-influxdb-auth -o jsonpath="{.data.influxdb-password}" | base64 -d.
We will use helm to setup grafana as well:.
let helm create the ingress by setting ingress.enabled to true in values/grafana/values.yaml
Deploy an own ingress: this is the way I prefer to do things because I use traefik as an ingress controller on my kubernetes cluster, that takes care of generating Let's Encrypt certificates automatically for any new ingress. Aside from that I did not want to expose grafana to the internet so I added a whitelist-source-range definition to the ingress to make sure that grafana only accepts incoming traffic coming from my local network.
Edit the hostname in manifests/grafana/ingress.yaml
Deploy the ingress: kubectl -n grafana apply -f manifests/grafana/ingress.yaml
The log receiver is a tcp socket listener written in nodejs that will get called from rsyslogd.
Build the container: docker build -t <your-dockerhub-name>/logincollector:<tag>
Push the container: docker push <your-dockerhub-name>/logincollector:<tag>
Change the deployment in manifests/logincollector/deployment.yaml according to your docker image
Create the namespace: kubectl create ns logincollector
Deploy: kubectl -n logincollector apply -f manifests/logincollector/
Finally we will setup the dashboard in grafana:.
Create a new dashboard names "Login Attempts"
Add the World panel and edit it
Go to [General] and edit the title: "Failed Login Attempts"
Go to [Metric] and add "InfluxDB" as datasource
Edit the query to be SELECT "value" AS "metric" FROM "login-attempts".."geossh" WHERE $timeFilter GROUP BY "geohash"
Set the format to Table
Go to [Worldmap] and edit the visual options to suit your needs (defaults are fine as well)
In "Map data options" set "Location data" to geohash, "Geohash field" to geohash, "Metric field" to metric