I have an Ubuntu 10.04 VPS box. It's been installed for a couple of days and only has ssh, postfix/dovecot running. The server is intended to be used for my personal needs like e-mail and RoR development. My
/var/log/auth.log is already roughly 300k and is full of messages like these:
Jul 4 03:18:36 artemis sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.104.22.168 user=root Jul 4 03:18:38 artemis sshd: Failed password for root from 22.214.171.124 port 58040 ssh2 Jul 4 03:18:39 artemis sshd: reverse mapping checking getaddrinfo for 66-96-201-81.static.hostnoc.net [126.96.36.199] failed - POSSIBLE BREAK-IN ATTEMPT!
There are other random users, which they tried to log in with, such as
alex and so on. I randomly did whois on some of the IP addresses and they seem to belong to China, Uruguay, Ecuador and some other countries.
How common are such brute force break-in attempts? Do I need to worry? Should I install firewall or take any other security measures?