Possible Duplicate:
Is it worth the effort to block failed login attempts
Is it normal to get hundreds of break-in attempts per day?
I'm managing a number of completely different root servers in different data centers and I notice a quite high number of failed SSH login attemts on most of them. Here is a snapshot from the past three days:
There is no regular pattern, but generally I log a few hundred attempts a day. To me this seems like botnets randonly trying to enter into foreign servers. I use rather safe passwords, but still: should I be concerned or do something about this?
Best would probably be to change the SSH port, but that is not possible in all cases.
Anyway, is this normal?
NB: The PublicKey logins are as expected.