내 상자가 공격받고 있어요

이제 digitalocean 상자에 로그인했으므로 로그에서 이 내용을 확실히 볼 수 있습니다. 어떤 종류의 스크립트가 침입을 시도하고 있는 것 같습니다.

Mar  8 13:25:25 sshd[11311]: Invalid user schedule from 216.157.31.144
Mar  8 13:25:25 sshd[11311]: input_userauth_request: invalid user schedule [preauth]
Mar  8 13:25:25 sshd[11311]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:25:25 sshd[11311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.157.31.144 
Mar  8 13:25:27 sshd[11311]: Failed password for invalid user schedule from 216.157.31.144 port 32774 ssh2
Mar  8 13:25:27 sshd[11311]: Received disconnect from 216.157.31.144: 11: Bye Bye [preauth]
Mar  8 13:26:26 sshd[11313]: reverse mapping checking getaddrinfo for new.mega.nn.ru [93.183.127.194] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar  8 13:26:26 sshd[11313]: Invalid user toor from 93.183.127.194
Mar  8 13:26:26 sshd[11313]: input_userauth_request: invalid user toor [preauth]
Mar  8 13:26:26 sshd[11313]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:26:26 sshd[11313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.183.127.194 
Mar  8 13:26:28 sshd[11313]: Failed password for invalid user toor from 93.183.127.194 port 48789 ssh2
Mar  8 13:26:28 sshd[11313]: Received disconnect from 93.183.127.194: 11: Bye Bye [preauth]
Mar  8 13:28:08 sshd[11315]: Invalid user administrator from 24.24.96.163
Mar  8 13:28:08 sshd[11315]: input_userauth_request: invalid user administrator [preauth]
Mar  8 13:28:08 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:28:08 sshd[11315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.24.96.163 
Mar  8 13:28:09 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar  8 13:28:10 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:28:12 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar  8 13:28:12 sshd[11315]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:28:14 sshd[11315]: Failed password for invalid user administrator from 24.24.96.163 port 49685 ssh2
Mar  8 13:28:14 sshd[11315]: Connection closed by 24.24.96.163 [preauth]
Mar  8 13:28:14 sshd[11315]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.24.96.163 
Mar  8 13:28:18 sshd[11317]: Did not receive identification string from 80.78.102.189
Mar  8 13:28:19 sshd[11318]: reverse mapping checking getaddrinfo for zbmo-ll.umn.ru [80.78.102.189] failed - POSSIBLE BREAK-IN ATTEMPT!
Mar  8 13:28:19 sshd[11318]: Invalid user admin from 80.78.102.189
Mar  8 13:28:19 sshd[11318]: input_userauth_request: invalid user admin [preauth]
Mar  8 13:28:19 sshd[11318]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:28:19 sshd[11318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.78.102.189 
Mar  8 13:28:21 sshd[11318]: Failed password for invalid user admin from 80.78.102.189 port 50953 ssh2
Mar  8 13:28:21 sshd[11318]: Connection closed by 80.78.102.189 [preauth]
Mar  8 13:31:03 sshd[11331]: Invalid user schiko from 216.157.31.144
Mar  8 13:31:03 sshd[11331]: input_userauth_request: invalid user schiko [preauth]
Mar  8 13:31:03 sshd[11331]: pam_unix(sshd:auth): check pass; user unknown
Mar  8 13:31:03 sshd[11331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.157.31.144 
Mar  8 13:31:04 sshd[11331]: Failed password for invalid user schiko from 216.157.31.144 port 20222 ssh2
Mar  8 13:31:04 sshd[11331]: Received disconnect from 216.157.31.144: 11: Bye Bye [preauth]
Mar  8 13:31:48 sshd[11333]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90  user=root
Mar  8 13:31:50 sshd[11333]: Failed password for root from 125.88.177.90 port 27353 ssh2
Mar  8 13:31:55  sshd[11333]: last message repeated 2 times
Mar  8 13:31:55 sshd[11333]: Received disconnect from 125.88.177.90: 11:  [preauth]
Mar  8 13:31:55 sshd[11333]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90  user=root
Mar  8 13:31:58 sshd[11335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90  user=root
Mar  8 13:32:00 sshd[11335]: Failed password for root from 125.88.177.90 port 57212 ssh2
Mar  8 13:32:05  sshd[11335]: last message repeated 2 times
Mar  8 13:32:05 sshd[11335]: Received disconnect from 125.88.177.90: 11:  [preauth]
Mar  8 13:32:05 sshd[11335]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90  user=root
Mar  8 13:32:08 sshd[11337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.88.177.90  user=root
Mar  8 13:32:10 sshd[11337]: Failed password for root from 125.88.177.90 port 35022 ssh2
Mar  8 13:32:15  sshd[11337]: last message repeated 2 times
Mar  8 13:32:15 sshd[11337]: Received disconnect from 125.88.177.90: 11:  [preauth]

여러 IP가 접속하려고 시도하는 모습이 보입니다!

마친 후lsof -i | less

출력 끝부분에서 이것을 볼 수 있습니다. 이 125-ip가 존재하는 것 같나요?

sshd     11548     root    3r  IPv4 5046701      0t0  TCP 178.62.190.116:ssh->125.88.177.90:23216 (ESTABLISHED)
sshd     11549     sshd    3u  IPv4 5046701      0t0  TCP 178.62.190.116:ssh->125.88.177.90:23216 (ESTABLISHED)

Droplet에 액세스하기 위해 비밀번호 없는 SSH 로그인으로 내 개인 키를 사용하고 있지만, 제가 아는 한 비밀번호가 추측되면 루트 사용자가 계속 로그인할 수 있습니다. 그렇죠?