I recently set up SSH access to a small Ubuntu box which I currently log into both from my local network and from offsite.
Currently I just have 2 users that are remoting in, but checking my /var/logs/auth.log I see TONS of random username/port combination attempted logins that look like this:
Failed password for invalid user buildbot from xxx.92.16.81 port 11934 ssh2
Received disconnect from xxx.92.16.81 port 11934:11: Bye Bye [preauth]
Disconnected from invalid user buildbot xxx.92.16.81 port 11934 [preauth]
Invalid user aimax from xxx.92.16.81 port 24768
pam_unix(sshd:auth): check pass; user unknown
pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=xxx.92.16.81
While I suppose this is not super threatening as I only have two users on the allowed users section of sshd_config, it is kinda nerve wracking to see that people really want to try to get in and my poor server is handling what looks like hundreds of these per day.
Is there a way (either through the router/firewall or the server itself (ip tables maybe?)) that I can have it just ignore or throw away SSH requests that are not for the allowed users on the specific port 22?
Generally speaking, what steps could I take to make sure my SSH is as secure as possible while still being able to log in when I'm not home?
edit: I had not configured my SSHD_config as I thought I had, updated for AllowedUsers, scary