Some useless punks Must be trying to break into my mcchine
(so it appears)

Im seeing this in /var/log/messages:

Oct 11 00:52:52 My_Machine_Name sshd(pam_unix)[12728]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=ol94-241.fibertel.com.ar
Oct 11 00:52:56 My_Machine_Name sshd(pam_unix)[12730]: check pass; user unknown
Oct 11 00:52:56 My_Machine_Name sshd(pam_unix)[12730]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=ol94-241.fibertel.com.ar

Oct 11 11:39:21 My_Machine_Name sshd(pam_unix)[16219]: check pass; user unknown
Oct 11 11:39:25 My_Machine_Name sshd(pam_unix)[16221]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.106.179.139


And in /var/log/secure, this is showing up:

Oct 9 20:24:20 My_Machine_Name sshd[3633]: Failed password for root from 60.248.193.86 port 56140 ssh2
Oct 9 20:24:25 My_Machine_Name sshd[3635]: Failed password for illegal user optic from 60.248.193.86 port 56462 ssh2
Oct 9 20:24:31 My_Machine_Name sshd[3637]: Failed password for illegal user service from 60.248.193.86 port 56793 ssh2
Oct 9 20:24:37 My_Machine_Name sshd[3639]: Failed password for illegal user admin from 60.248.193.86 port 57117 ssh2

A) is there any way to Block These address ?
B) Can i increase "Failed Login Delay", to at least slow them down ?
(if so, how ?)
C) i dont know just how secure my machine is, how can i know, What Can I Do ???? '-(

Moved: This thread is more suitable in Linux-Security and has been moved accordingly to help your thread/question get the exposure it deserves.

A) is there any way to Block These address ?
Sure. Search this forum, there are a few ways. If you only allow/need ssh for administrative purposes the easiest way is to tighten access (firewall, /etc/hosts.{allow,deny}, Xinetd if you use that) to a few "known good" subnets admins ssh in from.


B) Can i increase "Failed Login Delay", to at least slow them down ?
All I can say is I wouldn't waste time playing around with minor stuff like timing tricks when there's stuff to do with greater benefits.


C) i dont know just how secure my machine is, how can i know, What Can I Do
Make a start hardening your box and network. Run a Nessus scan from a remote host, install and run Tiger and/or LSAT (NSAT, not Mixter's stuff) and continue by checking out the LQ FAQ: Security references.