[Server] Is this normal? I think I'm under attack...

Sadly SSH hammering is "part of the daily routine". You can be sure that all those hosts are infected with some sort of malware.

Just make sure your users doesn't have any weak passwords, and things won't affect you that much. Let's just say that I see ... plenty of those on my boxen as well.

FreeBSD can take "quite a pounding" before going unresponsive (I should know, I've been using FreeBSD for server tasks for quite some while)

//Svein

 

Really didn't need to have all the list of blocked IP's.

They were all in the text file

 

Ever since I switched the port number I only have 2 fields entered into the deniedssh list which blocked out 2 attackers. So this seems quite promising.

Cheers,
deltatux