output of the "lastb" command

Question

In my $ sudo lastb, I found so many lines of bad login attempts(?).
Are they all hacking attempts against my publicly accessible server? I just noticed that I had 881 times of bad login attempts for only one day (Feb. 24)
Look at my output of the $ sudo lastb command below:

$ sudo lastb
...
...
root     ssh:notty    116.31.116.33    Fri Feb 24 18:51 - 18:51  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:49 - 18:49  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:49 - 18:49  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:49 - 18:49  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:48 - 18:48  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:48 - 18:48  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:48 - 18:48  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:47 - 18:47  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:47 - 18:47  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:47 - 18:47  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:46 - 18:46  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:46 - 18:46  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:46 - 18:46  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:45 - 18:45  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:44 - 18:44  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:44 - 18:44  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:43 - 18:43  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:43 - 18:43  (00:00)
root     ssh:notty    116.31.116.33    Fri Feb 24 18:43 - 18:43  (00:00)
root     ssh:notty    179.85.126.212   Fri Feb 24 17:15 - 17:15  (00:00)
root     ssh:notty    179.85.126.212   Fri Feb 24 17:15 - 17:15  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
root     ssh:notty    121.139.93.109   Fri Feb 24 16:16 - 16:16  (00:00)
toor     ssh:notty    185.144.157.8    Fri Feb 24 15:37 - 15:37  (00:00)
toor     ssh:notty    185.144.157.8    Fri Feb 24 15:36 - 15:36  (00:00)

btmp begins Fri Feb 24 15:36:58 2017
[woogon@cafe24 ~]$ sudo lastb | wc -l
9743
[woogon@cafe24 ~]$ sudo lastb | grep Feb 24 | wc -l
grep: 24: No such file or directory
0
[woogon@cafe24 ~]$ sudo lastb | grep "Feb 24" | wc -l
881

What would be my defensive actions to this?

Thank you in advance.
Woogon

Answer 1

I think the standard procedures here would be

A) Disable root ssh

and

B) Disable password authentication - use public key instead

To disable root ssh login, in /etc/ssh/sshd_config set PermitRootLogin no

There are plenty of tutorials that'll walk you through setting up public key authentication for ssh but it boils down to:

1. Create a public/private key pair on your client machine with ssh-keygen
2. Copy the public key to the server with ssh-copy-id
3. In /etch/ssh/sshd_config (on your server) set PubkeyAuthentication yes
4. Log in using the public key to verify it worked (if not check file permissions for /.ssh/ and /.ssh/authorized_keys, they usually give me trouble)
5. In /etc/ssh/sshd_config set PasswordAuthentication no

Answer 2

Use the TCP Wrapper files /etc/hosts.allow and /etc/hosts.deny to limit ssh connections to specific FQDN or IP addresses.

The use of these files is described here.

https://www.lifewire.com/hostsdeny-linux-command-4094617

Be sure to include your local private network IP address range in /etc/hosts.allow so that you can continue to connect uninterrupted.

An example for allowing all IP addresses in the 192.168.0.* block would be:

ALL: 192.168.0.

Notice the trailing dot. That is the syntax for allowing all addresses in that range.