My server is getting a lot of various failed authentication attempts for various accounts. The most common one (that I've seen ) or the root account.
I have since enabled Fail2Ban and ran several rootkit / malware checks to ensure I wasn't compromised. Is there anything else I should do? I only have three accounts enabled, and SSH access for only two. I have a full 48hr ban on anyone making more then six failed SSH login attempts. I do not have FTP enabled.
if you are using public/private key pairs you have almost nothing to worry about, with the brute force login attempts. if you have password authentication disabled, that is.
you can run ssh on a non-standard port, like 2222 but you will, in short time, start seeing attempts on those ports, too, as a lot of the botnets run port scanners as well.
another thing you can look into setting up is port-knocking, which is a pain, but would lock down ssh to only people issuing the proper "knock", http://en.wikipedia.org/wiki/Port_knocking
Disable password authentication and root logins by adding/changing the following lines in your sshd_config file (typically located at /etc/ssh/sshd_config)
PasswordAuthentication no
PermitRootLogin no
What you're seeing is normal - it has been happening on the open Internet for years now and will never stop.
You will need to get public key authorization figured out before turning off passwords, if you haven't done this already.
I get those all the time, they never end. The best thing is just to make sure you arent using generic accounts that have generic passwords.
I also use fail2ban, and it has worked fine. (But most of the time, I get hit by all different hosts, so it doesn't help too much)
