I'm seeing a lot of log entries that appear to be failed login attempts from unknown IP addresses.  

I am using private and public keys to log in with SSH but I have noticed that even with private and public keys set I am able to log in to my server with filezilla without running pageant. Is this normal? What should I do to further protect myself from what seems like a brute force attack?

Heres the log:

Oct  3 14:11:52 xxxxxx sshd[29938]: Invalid user postgres from 212.64.151.233
Oct  3 14:11:52 xxxxxx sshd[29938]: input_userauth_request: invalid user postgres [preauth]
Oct  3 14:11:52 xxxxxx sshd[29938]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:52 xxxxxx sshd[29940]: Invalid user postgres from 212.64.151.233
Oct  3 14:11:52 xxxxxx sshd[29940]: input_userauth_request: invalid user postgres [preauth]
Oct  3 14:11:52 xxxxxx sshd[29940]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:52 xxxxxx sshd[29942]: Invalid user postgres from 212.64.151.233
Oct  3 14:11:52 xxxxxx sshd[29942]: input_userauth_request: invalid user postgres [preauth]
Oct  3 14:11:52 xxxxxx sshd[29942]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:52 xxxxxx sshd[29944]: Invalid user postgres from 212.64.151.233
Oct  3 14:11:52 xxxxxx sshd[29944]: input_userauth_request: invalid user postgres [preauth]
Oct  3 14:11:52 xxxxxx sshd[29944]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:52 xxxxxx sshd[29946]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:52 xxxxxx sshd[29948]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:52 xxxxxx sshd[29950]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:52 xxxxxx sshd[29952]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:53 xxxxxx sshd[29954]: Invalid user admin from 212.64.151.233
Oct  3 14:11:53 xxxxxx sshd[29954]: input_userauth_request: invalid user admin [preauth]
Oct  3 14:11:53 xxxxxx sshd[29954]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:53 xxxxxx sshd[29956]: Invalid user admin from 212.64.151.233
Oct  3 14:11:53 xxxxxx sshd[29956]: input_userauth_request: invalid user admin [preauth]
Oct  3 14:11:53 xxxxxx sshd[29956]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:53 xxxxxx sshd[29958]: Invalid user admin from 212.64.151.233
Oct  3 14:11:53 xxxxxx sshd[29958]: input_userauth_request: invalid user admin [preauth]
Oct  3 14:11:53 xxxxxx sshd[29958]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:53 xxxxxx sshd[29960]: User mysql not allowed because account is locked
Oct  3 14:11:53 xxxxxx sshd[29960]: input_userauth_request: invalid user mysql [preauth]
Oct  3 14:11:53 xxxxxx sshd[29960]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:53 xxxxxx sshd[29962]: User mysql not allowed because account is locked
Oct  3 14:11:53 xxxxxx sshd[29962]: input_userauth_request: invalid user mysql [preauth]
Oct  3 14:11:53 xxxxxx sshd[29962]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:53 xxxxxx sshd[29964]: Invalid user prueba from 212.64.151.233
Oct  3 14:11:53 xxxxxx sshd[29964]: input_userauth_request: invalid user prueba [preauth]
Oct  3 14:11:53 xxxxxx sshd[29964]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:53 xxxxxx sshd[29966]: Invalid user prueba from 212.64.151.233
Oct  3 14:11:53 xxxxxx sshd[29966]: input_userauth_request: invalid user prueba [preauth]
Oct  3 14:11:53 xxxxxx sshd[29966]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:53 xxxxxx sshd[29968]: Invalid user usuario from 212.64.151.233
Oct  3 14:11:53 xxxxxx sshd[29968]: input_userauth_request: invalid user usuario [preauth]
Oct  3 14:11:53 xxxxxx sshd[29968]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:54 xxxxxx sshd[29970]: Invalid user usuario from 212.64.151.233
Oct  3 14:11:54 xxxxxx sshd[29970]: input_userauth_request: invalid user usuario [preauth]
Oct  3 14:11:54 xxxxxx sshd[29970]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:54 xxxxxx sshd[29972]: Invalid user admin from 212.64.151.233
Oct  3 14:11:54 xxxxxx sshd[29972]: input_userauth_request: invalid user admin [preauth]
Oct  3 14:11:54 xxxxxx sshd[29972]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:54 xxxxxx sshd[29974]: Invalid user nagios from 212.64.151.233
Oct  3 14:11:54 xxxxxx sshd[29974]: input_userauth_request: invalid user nagios [preauth]
Oct  3 14:11:54 xxxxxx sshd[29974]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:54 xxxxxx sshd[29976]: Invalid user nagios from 212.64.151.233
Oct  3 14:11:54 xxxxxx sshd[29976]: input_userauth_request: invalid user nagios [preauth]
Oct  3 14:11:54 xxxxxx sshd[29976]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:54 xxxxxx sshd[29978]: Invalid user nagios from 212.64.151.233
Oct  3 14:11:54 xxxxxx sshd[29978]: input_userauth_request: invalid user nagios [preauth]
Oct  3 14:11:54 xxxxxx sshd[29978]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:54 xxxxxx sshd[29980]: Invalid user nagios from 212.64.151.233
Oct  3 14:11:54 xxxxxx sshd[29980]: input_userauth_request: invalid user nagios [preauth]
Oct  3 14:11:54 xxxxxx sshd[29980]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:54 xxxxxx sshd[29982]: Invalid user oracle from 212.64.151.233
Oct  3 14:11:54 xxxxxx sshd[29982]: input_userauth_request: invalid user oracle [preauth]
Oct  3 14:11:54 xxxxxx sshd[29982]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:54 xxxxxx sshd[29984]: Invalid user oracle from 212.64.151.233
Oct  3 14:11:54 xxxxxx sshd[29984]: input_userauth_request: invalid user oracle [preauth]
Oct  3 14:11:54 xxxxxx sshd[29984]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:54 xxxxxx sshd[29986]: Invalid user oracle from 212.64.151.233
Oct  3 14:11:54 xxxxxx sshd[29986]: input_userauth_request: invalid user oracle [preauth]
Oct  3 14:11:54 xxxxxx sshd[29986]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:55 xxxxxx sshd[29988]: Invalid user oracle from 212.64.151.233
Oct  3 14:11:55 xxxxxx sshd[29988]: input_userauth_request: invalid user oracle [preauth]
Oct  3 14:11:55 xxxxxx sshd[29988]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:55 xxxxxx sshd[29990]: Invalid user ftpuser from 212.64.151.233
Oct  3 14:11:55 xxxxxx sshd[29990]: input_userauth_request: invalid user ftpuser [preauth]
Oct  3 14:11:55 xxxxxx sshd[29990]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:55 xxxxxx sshd[29992]: Invalid user ftpuser from 212.64.151.233
Oct  3 14:11:55 xxxxxx sshd[29992]: input_userauth_request: invalid user ftpuser [preauth]
Oct  3 14:11:55 xxxxxx sshd[29992]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:55 xxxxxx sshd[29994]: Invalid user ftpuser from 212.64.151.233
Oct  3 14:11:55 xxxxxx sshd[29994]: input_userauth_request: invalid user ftpuser [preauth]
Oct  3 14:11:55 xxxxxx sshd[29994]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:55 xxxxxx sshd[29996]: Invalid user guest from 212.64.151.233
Oct  3 14:11:55 xxxxxx sshd[29996]: input_userauth_request: invalid user guest [preauth]
Oct  3 14:11:55 xxxxxx sshd[29996]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:55 xxxxxx sshd[29998]: Invalid user guest from 212.64.151.233
Oct  3 14:11:55 xxxxxx sshd[29998]: input_userauth_request: invalid user guest [preauth]
Oct  3 14:11:55 xxxxxx sshd[29998]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:55 xxxxxx sshd[30000]: Invalid user guest from 212.64.151.233
Oct  3 14:11:55 xxxxxx sshd[30000]: input_userauth_request: invalid user guest [preauth]
Oct  3 14:11:55 xxxxxx sshd[30000]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:55 xxxxxx sshd[30002]: Invalid user guest from 212.64.151.233
Oct  3 14:11:55 xxxxxx sshd[30002]: input_userauth_request: invalid user guest [preauth]
Oct  3 14:11:55 xxxxxx sshd[30002]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:56 xxxxxx sshd[30004]: Invalid user test from 212.64.151.233
Oct  3 14:11:56 xxxxxx sshd[30004]: input_userauth_request: invalid user test [preauth]
Oct  3 14:11:56 xxxxxx sshd[30004]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:56 xxxxxx sshd[30006]: Invalid user test from 212.64.151.233
Oct  3 14:11:56 xxxxxx sshd[30006]: input_userauth_request: invalid user test [preauth]
Oct  3 14:11:56 xxxxxx sshd[30006]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:56 xxxxxx sshd[30008]: Invalid user test from 212.64.151.233
Oct  3 14:11:56 xxxxxx sshd[30008]: input_userauth_request: invalid user test [preauth]
Oct  3 14:11:56 xxxxxx sshd[30008]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:56 xxxxxx sshd[30010]: Invalid user test from 212.64.151.233
Oct  3 14:11:56 xxxxxx sshd[30010]: input_userauth_request: invalid user test [preauth]
Oct  3 14:11:56 xxxxxx sshd[30010]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:56 xxxxxx sshd[30012]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:56 xxxxxx sshd[30014]: Invalid user user from 212.64.151.233
Oct  3 14:11:56 xxxxxx sshd[30014]: input_userauth_request: invalid user user [preauth]
Oct  3 14:11:56 xxxxxx sshd[30014]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:56 xxxxxx sshd[30016]: Invalid user user from 212.64.151.233
Oct  3 14:11:56 xxxxxx sshd[30016]: input_userauth_request: invalid user user [preauth]
Oct  3 14:11:56 xxxxxx sshd[30016]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:56 xxxxxx sshd[30018]: Invalid user user from 212.64.151.233
Oct  3 14:11:56 xxxxxx sshd[30018]: input_userauth_request: invalid user user [preauth]
Oct  3 14:11:56 xxxxxx sshd[30018]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:57 xxxxxx sshd[30020]: Invalid user user from 212.64.151.233
Oct  3 14:11:57 xxxxxx sshd[30020]: input_userauth_request: invalid user user [preauth]
Oct  3 14:11:57 xxxxxx sshd[30020]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:57 xxxxxx sshd[30022]: Invalid user jboss from 212.64.151.233
Oct  3 14:11:57 xxxxxx sshd[30022]: input_userauth_request: invalid user jboss [preauth]
Oct  3 14:11:57 xxxxxx sshd[30022]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:57 xxxxxx sshd[30024]: Invalid user jboss from 212.64.151.233
Oct  3 14:11:57 xxxxxx sshd[30024]: input_userauth_request: invalid user jboss [preauth]
Oct  3 14:11:57 xxxxxx sshd[30024]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:57 xxxxxx sshd[30026]: Invalid user squid from 212.64.151.233
Oct  3 14:11:57 xxxxxx sshd[30026]: input_userauth_request: invalid user squid [preauth]
Oct  3 14:11:57 xxxxxx sshd[30026]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:57 xxxxxx sshd[30028]: Invalid user squid from 212.64.151.233
Oct  3 14:11:57 xxxxxx sshd[30028]: input_userauth_request: invalid user squid [preauth]
Oct  3 14:11:57 xxxxxx sshd[30028]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:57 xxxxxx sshd[30030]: Invalid user temp from 212.64.151.233
Oct  3 14:11:57 xxxxxx sshd[30030]: input_userauth_request: invalid user temp [preauth]
Oct  3 14:11:57 xxxxxx sshd[30030]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:57 xxxxxx sshd[30032]: Invalid user svn from 212.64.151.233
Oct  3 14:11:57 xxxxxx sshd[30032]: input_userauth_request: invalid user svn [preauth]
Oct  3 14:11:57 xxxxxx sshd[30032]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]
Oct  3 14:11:57 xxxxxx sshd[30034]: Invalid user ts from 212.64.151.233
Oct  3 14:11:57 xxxxxx sshd[30034]: input_userauth_request: invalid user ts [preauth]
Oct  3 14:11:57 xxxxxx sshd[30034]: Received disconnect from 212.64.151.233: 11: Bye Bye [preauth]


It is very common. Many botnets try to spread that way, so this is a wide scale mindless attack. Mitigation measures include:


Use passwords with high entropy which are very unlikely to be brute-forced.
Disable SSH login for root.
Use an "unlikely" user name, which botnets will not use.
Disable password-based authentication altogether.
Run the SSH server on another port than 22.
Use fail2ban to reject attackers' IP automatically or slow them down.
Allow SSH connections only from a whitelist of IP (beware not to lock yourself out if your home IP is nominally dynamic !).


Most of these measures are about keeping your log files small; even when the brute force does not succeed, the thousands of log entries are a problem since they can hide actual targeted attacks. A bit of security through obscurity (such as the unlikely user name and the port change) works marvels against mindless attackers: yeah, security through obscurity is bad and wrong and so on, but sometimes it works and you will not get fried by a vengeful deity if you use it sensibly.

A high entropy password will be effective against intelligent attackers, though, and can only be recommended in all situations.
