SSH scans are usually brute-force attacks. They just try common usernames with easy, common passwords. I've seen a system get compromised using the
guest account, with password ‘guest’. Sigh.
Most machines are sprayed with such packets all the time. As a blanket solution, I like to do two things on the firewall:
ipset to allow access to port 22/tcp from specific countries only. There's a unusually high percentage of these attacks originating in
.cn netblocks, for instance.
Use rate limiting on 22/tcp
SYN packets so that the same IP address can only connect N times a minute before getting blocked for 10 or 15 minutes. This deters scanning software, and also slows down potential damage to other people's networks. It's a community service.
There are other ways too depending on your needs and restrictions.
On the target computers themselves, you should also lock down system accounts and implement a password policy that forbids easy passwords (wordlist checking, minimum length, etc).