If I turn on OS X "Remote Login" (i.e., ssh access), my console log gets regular messages like the following:
22/04/2015 13:05:23.364 sshd[2118]: error: PAM: authentication error for root from 43.255.190.157 via 10.0.1.10
These occur about once a second for long periods of time. The IP address of the attacker changes from time to time (but it usually stays at something like 43.255.190.* for a while). Turning off ssh access stops the attacks for a few minutes, but they usually restart within a little of while if restarting Remote Login (which I do need!).
I am not particularly worried about the actual attack succeeding (in particular, I've got the root account turned off) but should I be worried about excess network traffic and just filling up the log files with un-necessary crap? I would strongly prefer not to have to use any third-party software if possible.
My machine is behind a cable modem and Apple Time Capsule which does all the NAT stuff and forwards appropriate ports to this machine.
For what it's worth, under Mavericks /etc/hosts.deny doesn't seem to have any effect, but I understand that I could possibly use pfctl
?
(I've got a similar question about VNC attacks...)