Watch auth.log for Invalid ssh logins, geolocate the IP, then map it