[Hardening] F-15: Failure to Block Abusers by IPs.

### The required feature described as a wish

**Description:** CloudStack does not monitor or restrict API authentication attempts based on the source IP address. A single client can submit unlimited failed authentication attempts across any number of accounts without being identified or blocked.

**Affected Components:** Management API

**Impact:** An attacker operating from a single source address can systematically target multiple user accounts with repeated failed login attempts, deliberately triggering lockouts across all accounts, preventing legitimate users and administrators from accessing the platform.

**Steps to Reproduce:**
- Using a custom script or a brute-forcing tool (e.g., `hydra`), send a high volume of failed authentication attempts targeting multiple user accounts.
- Observe that the requests are processed without any source IP tracking, flagging, or blocking.
- Confirm that targeted accounts transition to a disabled state while the source IP remains unrestricted.

**Recommended Remediation:** Log all authentication attempts and source IPs to `/var/log/cloudstack/management/auth.log` so tools like Fail2Ban can automatically detect brute-force attacks and block malicious traffic (via `iptables` or `nftables`). For even faster protection, a system administrator can craft a custom script using `inotify` to trigger real-time blocks via network edge appliances, stopping attackers' traffic before they ever reach CloudStack.

從 CloudStack Management API 驗證流程開始，確定可以在哪裡觀察失敗的嘗試和來源 IP。使用建議輸出至 /var/log/cloudstack/management/auth.log 作為預期的整合點，然後使用自訂腳本或 hydra 重現攻擊，並驗證嘗試是否以 Fail2Ban 可用於封鎖的形式記錄。

由索引模型根據 Issue 內容生成。