[Hardening] F-15: Failure to Block Abusers by IPs.

### The required feature described as a wish

**Description:** CloudStack does not monitor or restrict API authentication attempts based on the source IP address. A single client can submit unlimited failed authentication attempts across any number of accounts without being identified or blocked.

**Affected Components:** Management API

**Impact:** An attacker operating from a single source address can systematically target multiple user accounts with repeated failed login attempts, deliberately triggering lockouts across all accounts, preventing legitimate users and administrators from accessing the platform.

**Steps to Reproduce:**
- Using a custom script or a brute-forcing tool (e.g., `hydra`), send a high volume of failed authentication attempts targeting multiple user accounts.
- Observe that the requests are processed without any source IP tracking, flagging, or blocking.
- Confirm that targeted accounts transition to a disabled state while the source IP remains unrestricted.

**Recommended Remediation:** Log all authentication attempts and source IPs to `/var/log/cloudstack/management/auth.log` so tools like Fail2Ban can automatically detect brute-force attacks and block malicious traffic (via `iptables` or `nftables`). For even faster protection, a system administrator can craft a custom script using `inotify` to trigger real-time blocks via network edge appliances, stopping attackers' traffic before they ever reach CloudStack.

Iniziare con il flusso di autenticazione di CloudStack Management API e determinare dove è possibile osservare i tentativi falliti e gli indirizzi IP di origine. Utilizzare l'output proposto in /var/log/cloudstack/management/auth.log come punto di integrazione previsto, quindi riprodurre gli attacchi con uno script personalizzato o hydra e verificare che i tentativi vengano registrati in una forma che Fail2Ban possa utilizzare per bloccarli.

Scritto dal modello di indicizzazione a partire dal testo della issue.