I have been running Ubuntu Server for about four months and I learn something new everyday. Today I learned that there are many logs that i didnt know existed. When I examined these logs I was blown away. For example auth.log listed what I think are hacking attempts and failed ssh login attempts from many IP addresses.
My question is this. I am running Apache and I am connecting with ssh. What logs should I be most familiar with in order to monitor failed login attempts and what can I do to make ssh more secure and still be able to manage my server with it?
Also, I have noticed a crazy amount of traffic at two different times when no one should have been connected to the server (using vnstat -l), but still havent figured out why. Where can I get started tracking this down.
I realize this is many questions packed into one and i apologize for that. I still a little stunned at what I have discovered so far.