(skip to the end for less context)
I have a CentOS 6 box with a few security measures taken - disabled root login, strong passwords, and user whitelist for FTP and SSH, and fail2ban installed. I get the 'usual' level of attempted logins for SSH, FTP, and SMTP, all of which fail2ban deals with satisfactorily. Unfortunately I can't change SSH port number or enforce keys, although it's on my list to do when possible.
Today I noticed a more serious attack; something I've not seen before. The same IP was repeatedly attempting root login on SSH, but it was hitting random ports (max 3 tries on each) and somehow not getting banned by fail2ban - I assumed this was because of the random port numbers.
After some investigation of
/var/log/secure there seemed to be 22K attempts in a matter of hours, so I manually added a rule to iptables to drop everything from that IP.
sshd: Failed password for invalid user root from x.x.x.x port 48811 ssh2
I don't know what the attacker was trying to accomplish here - was he looking for open ports, trying to bruteforce SSH, or port knocking? Aside from manually banning the attacker, I don't know what to do about it or where to look for more information.
In a *nix system, where should I look for evidence of an attack, and how should I interpret that information to inform what I do about it?