Кто настраивал работу fail2ban и guacamole подскажете?

Question

Guarmcze @Guarmcze

Удаленный доступ

Кто настраивал работу fail2ban и guacamole подскажете?

Здравствуйте.
Может кто-нибудь настраивал работу fail2ban и guacamole в свежих редакциях?
На какие логи нужно настраивать fail2ban? На логи Tomcat? Или другое?
Читал про томкат, но не знаю как определить не верный ввод логина и пароля. Или я не там смотрю? Nginx проксирует на томкат с Guacamole, все работает на одной машине.
В файле server.xml поднастраивал/менял только вот это:

spoiler

address="127.0.0.1"
URIEncoding="UTF-8"
port="8009"
redirectPort="8443" />
…
prefix="localhost_access_logGUAC." suffix=".txt"
remoteIpHeader="X-Forwarded-For"
requestAttributesEnabled="true"
internalProxies="127\.0\.0\.1"
pattern=" %{X-Forwarded-For}i %l %u %t "%r" %s %b" />

internalProxies="127\.0\.[0-1]\.1"
remoteIpHeader="x-forwarded-for"
requestAttributesEnabled="true"
protocolHeader="x-forwarded-proto"
protocolHeaderHttpsValue="https"/>

В логах томката появляется вот это:

spoiler

192.168.3.10 - - [08/Jul/2020:17:28:22 +0300] "GET /guacamole/app.js?v=1.2.0 HTTP/1.1" 200 371334
192.168.3.10 - - [08/Jul/2020:17:28:22 +0300] "GET /guacamole/app.css?v=1.2.0 HTTP/1.1" 200 60873
192.168.3.10 - - [08/Jul/2020:17:28:23 +0300] "GET /guacamole/api/patches HTTP/1.1" 200 352
192.168.3.10 - - [08/Jul/2020:17:28:23 +0300] "GET /guacamole/api/languages HTTP/1.1" 200 205
192.168.3.10 - - [08/Jul/2020:17:28:23 +0300] "GET /guacamole/translations/ru.json HTTP/1.1" 200 33038
192.168.3.10 - - [08/Jul/2020:17:28:23 +0300] "GET /guacamole/translations/en.json HTTP/1.1" 200 46959
192.168.3.10 - - [08/Jul/2020:17:28:23 +0300] "GET /guacamole/app/ext/tempnamespace/images/logo-placeholder.png HTTP/1.1" 200 3809
192.168.3.10 - - [08/Jul/2020:17:28:27 +0300] "POST /guacamole/api/tokens HTTP/1.1" 403 269
192.168.3.10 - - [08/Jul/2020:17:28:36 +0300] "POST /guacamole/api/tokens HTTP/1.1" 200 179
192.168.3.10 - - [08/Jul/2020:17:28:36 +0300] "POST /guacamole/api/tokens HTTP/1.1" 200 179
192.168.3.10 - - [08/Jul/2020:17:28:36 +0300] "GET /guacamole/api/patches?token=12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 200 352
192.168.3.10 - - [08/Jul/2020:17:28:37 +0300] "GET /guacamole/api/session/data/mysql-shared/self/permissions?token=12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 200 236
192.168.3.10 - - [08/Jul/2020:17:28:37 +0300] "GET /guacamole/api/session/data/mysql-shared/connectionGroups/ROOT/tree?token=12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 200 134
192.168.3.10 - - [08/Jul/2020:17:28:38 +0300] "GET /guacamole/api/session/data/mysql/self/permissions?token=12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 200 221
192.168.3.10 - - [08/Jul/2020:17:28:38 +0300] "GET /guacamole/api/session/data/mysql/connectionGroups/ROOT/tree?token=12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 200 937
192.168.3.10 - - [08/Jul/2020:17:28:38 +0300] "GET /guacamole/api/session/data/mysql-shared/self/effectivePermissions?token=12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 200 236
192.168.3.10 - - [08/Jul/2020:17:28:39 +0300] "GET /guacamole/api/session/data/mysql-shared/activeConnections?token=12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 200 12
192.168.3.10 - - [08/Jul/2020:17:28:39 +0300] "GET /guacamole/api/session/data/mysql/activeConnections?token=12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 200 12
192.168.3.10 - - [08/Jul/2020:17:28:39 +0300] "GET /guacamole/api/session/data/mysql/self/effectivePermissions?token=12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 200 258
192.168.3.10 - - [08/Jul/2020:17:28:39 +0300] "GET /guacamole/api/session/data/mysql/users/user1?token=12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 200 178
192.168.3.10 - - [08/Jul/2020:17:28:43 +0300] "DELETE /guacamole/api/tokens/12B3E6CED91A186DFF2D2E095DF0C0F72F95C099F72AF6E768BEE567E446B6D0 HTTP/1.1" 204 -
192.168.3.10 - - [08/Jul/2020:17:28:43 +0300] "POST /guacamole/api/tokens HTTP/1.1" 403 269