Bad guys warning

Doc/Sdi/CloudProvider/gettingStarted.xml

@@ -867,6 +867,25 @@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
 Someone could be eavesdropping on you right now (<emphasis role="red">man-in-the-middle attack</emphasis>)!</screen>
     </figure>
 
+    <figure xml:id="sdi_cloudProvider_cloudInit_watchOutForBadGuys">
+      <title>Watch out for your enemies!</title>
+
+      <screen>root@hello:~# journalctl -f
+May 06 04:41:20 hello cloud-init[898]: Cloud-init v. 22.4.2 finished at Mon, 06 May 2024 04:41:20 +0000. Datasource DataSourceHetzner.  Up 11.78 seconds
+   ...
+May 06 04:46:16 hello sshd[927]: Invalid user abc from 43.163.218.130 port 33408
+May 06 04:46:17 hello sshd[927]: Received disconnect from 43.163.218.130 port 33408:11: Bye Bye [preauth]
+May 06 04:46:17 hello sshd[927]: Disconnected from invalid user abc 43.163.218.130 port 33408 [preauth]
+   ...
+May 06 04:50:54 hello sshd[930]: fatal: Timeout before authentication for 27.128.243.225 port 59866
+   ...
+May 06 04:52:45 hello sshd[933]: Invalid user cos from 43.163.218.130 port 59776
+   ...
+May 06 04:53:04 hello sshd[935]: Invalid user admin from 194.169.175.35 port 51128
+May 06 04:53:49 hello sshd[937]: User root from 43.163.218.130 not allowed because not listed in AllowUsers
+May 06 04:53:49 hello sshd[937]: Disconnected from invalid user root 43.163.218.130 port 50592 [preauth]</screen>
+    </figure>
+
     <qandaset defaultlabel="qanda"
               xml:id="sdi_cloudProvider_cloudInit_qanda_gettingStarted">
       <title>Working on <productname>Cloud-init</productname></title>
@@ -898,8 +917,11 @@ Someone could be eavesdropping on you right now (<emphasis role="red">man-in-the
               </listitem>
 
               <listitem>
-                <para>Working on security modify your current
-                configuration:</para>
+                <para>With respect to <xref
+                linkend="sdi_cloudProvider_cloudInit_watchOutForBadGuys"/>
+                inspect the output of <command>journalctl -f</command> on your
+                own server for a while. Then modify your current
+                <command>sshd</command> configuration:</para>
 
                 <itemizedlist>
                   <listitem>