Bom dia pessoal,

Instalei e configurei o CSF ontem e analisando os logs de bloqueio de IP verifiquei mtas tentativas de login ao SSH. É normal isso? Algo adicional que possamos fazer pra aumentar a segurança neste tipo de tentativa?

Edit: Troquei a porta SSH  

59.47.5.233 # lfd: (sshd) Failed SSH login from 59.47.5.233 (CN/China/233.5.47.59.broad.bx.ln.dynamic.163data.com.cn): 5 in the last 3600 secs - Thu Mar 17 12:32:20 2016
183.3.202.102 # lfd: (sshd) Failed SSH login from 183.3.202.102 (CN/China/-): 5 in the last 3600 secs - Thu Mar 17 13:01:22 2016
117.3.65.28 # lfd: (sshd) Failed SSH login from 117.3.65.28 (VN/Vietnam/-): 5 in the last 3600 secs - Thu Mar 17 13:23:39 2016
104.171.125.103 # lfd: (sshd) Failed SSH login from 104.171.125.103 (US/United States/-): 5 in the last 3600 secs - Thu Mar 17 14:47:28 2016
118.70.179.128 # lfd: (sshd) Failed SSH login from 118.70.179.128 (VN/Vietnam/-): 5 in the last 3600 secs - Thu Mar 17 15:32:56 2016
122.141.236.69 # lfd: (sshd) Failed SSH login from 122.141.236.69 (CN/China/69.236.141.122.adsl-pool.jlccptt.net.cn): 5 in the last 3600 secs - Thu Mar 17 17:42:17 2016
185.112.102.160 # lfd: (sshd) Failed SSH login from 185.112.102.160 (RU/Russian Federation/-): 5 in the last 3600 secs - Thu Mar 17 19:04:27 2016
23.102.43.156 # lfd: (sshd) Failed SSH login from 23.102.43.156 (IE/Ireland/-): 5 in the last 3600 secs - Thu Mar 17 19:33:09 2016
62.181.8.237 # lfd: (sshd) Failed SSH login from 62.181.8.237 (PL/Poland/SECURITY-10.srv.rootbox.com): 5 in the last 3600 secs - Thu Mar 17 19:55:55 2016
42.187.122.133 # lfd: (sshd) Failed SSH login from 42.187.122.133 (CN/China/-): 5 in the last 3600 secs - Thu Mar 17 21:13:40 2016
117.34.70.143 # lfd: (sshd) Failed SSH login from 117.34.70.143 (CN/China/-): 5 in the last 3600 secs - Thu Mar 17 22:57:06 2016
185.110.132.54 # lfd: (sshd) Failed SSH login from 185.110.132.54 (RU/Russian Federation/-): 5 in the last 3600 secs - Fri Mar 18 02:28:43 2016
195.154.52.9 # lfd: (sshd) Failed SSH login from 195.154.52.9 (FR/France/195-154-52-9.rev.poneytelecom.eu): 5 in the last 3600 secs - Fri Mar 18 03:57:43 2016
222.186.21.103 # lfd: (sshd) Failed SSH login from 222.186.21.103 (CN/China/-): 5 in the last 3600 secs - Fri Mar 18 04:45:21 2016
185.103.252.14 # lfd: (sshd) Failed SSH login from 185.103.252.14 (RU/Russian Federation/-): 5 in the last 3600 secs - Fri Mar 18 06:13:06 2016
61.218.251.54 # lfd: (sshd) Failed SSH login from 61.218.251.54 (TW/Taiwan/61-218-251-54.HINET-IP.hinet.net): 5 in the last 3600 secs - Fri Mar 18 06:14:37 2016
208.67.1.57 # lfd: (sshd) Failed SSH login from 208.67.1.57 (US/United States/-): 5 in the last 3600 secs - Fri Mar 18 07:16:05 2016
23.101.129.8 # lfd: (sshd) Failed SSH login from 23.101.129.8 (US/United States/-): 5 in the last 3600 secs - Fri Mar 18 08:42:35 2016

Editando a porta para um numero complexo, já resolve.

Exatamente, alterar a porta SSH vai resolver e depois que alterar lembre-se de liberar ela no csf e bloquear a padrão.