I've installed OSSEC on my server and I've been getting reports similar to the following:
Jan 11 19:27:03 Daddy sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.104.22.168 user=root
Jan 11 19:26:54 Daddy sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=22.214.171.124 user=root
Repeated about 10 times per email. So far not a day has gone by without 3 or 4 of these emails from OSSEC. Of course my initial emotion is a bit of rage and "how dare they try to hack into my box!" but I guess that's the state of the 'net these days anyway. The other day I also had someone try with user bin
I also recieved this message:
Jan 12 02:04:07 Daddy sshd: reverse mapping checking getaddrinfo for static-52-53.mk-net.ru [126.96.36.199] failed - POSSIBLE BREAK-IN ATTEMPT!
(again, with multiple repeats)
I know at least one benign source of the reverse mapping comes from freenode when they try to make sure you're not a likely botnet, but I haven't gone checking about that source.
We're pretty sensitive about the issue of vulnerabilities, especially since a previous server was hacked (probably) via phpMyAdmin.
So obviously any advice/resources for securing our server would be appreciated, but my main question is this: should we be worried about these break-in attempts? The root user has no password (login disabled) so is it safe to ignore these failed logins? Is there anything else that I could or should do to limit the possible vulnerabilities along this avenue? This system is behind a router with only essential (e.g. services we're using) ports open (ssh, apache, and postfix).