I posted the latest logwatch report to the list. I believe those pam login failures are sshd connection attempts. Currently we're running SSHD on port 222. That redirection is so well known now that we might as well run it on 22. I would suggest that we chose a more random, arbitrary port and see if that cuts back on the hits.
--
Jonathan
