This question already has an answer here:
- Securing SSH server against bruteforcing 12 answers
By coincidence I looked at my servers ssh log (/var/log/auth.log) and I noticed that someone is constantly trying to gain access:
Sep 7 13:03:45 virt01 sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.104.22.168 user=root Sep 7 13:03:48 virt01 sshd: Failed password for root from 22.214.171.124 port 13423 ssh2 Sep 7 13:03:52 virt01 sshd: message repeated 2 times: [ Failed password for root from 126.96.36.199 port 13423 ssh2] Sep 7 13:03:52 virt01 sshd: Received disconnect from 188.8.131.52: 11: [preauth]
This happens a few times every minute, and has been going on for a long time without me knowing about it.
Question Should I be concerned about this, if yes: What should I do about it?