If I use cat /var/log/messages | grep haas, it get only two distinct messages:
2018-01-31T22:09:14+00:00 info twisted: [haas_proxy.proxy.ProxySSHFactory] disabling non-fixed-group key exchange algorithms because we cannot find moduli file
2018-01-31T22:10:01+00:00 info /usr/sbin/cron[26780]: (root) CMD (/etc/init.d/haas-proxy enabled && /etc/init.d/haas-proxy check_fw)
If I use cat /var/log/messages | grep ssh, it get this over, and over again:
2018-01-31T22:10:39+00:00 info twisted: [SSHService ssh-connection on SSHServerTransport,1179,5.188.87.53] got channel direct-tcpip request
2018-01-31T22:10:39+00:00 alert twisted: [SSHService ssh-connection on SSHServerTransport,1179,5.188.87.53] channel open failed
2018-01-31T22:10:39+00:00 alert twisted: [SSHService ssh-connection on SSHServerTransport,1179,5.188.87.53] Traceback (most recent call last):
2018-01-31T22:10:39+00:00 alert twisted: [SSHService ssh-connection on SSHServerTransport,1179,5.188.87.53] Failure: twisted.conch.error.ConchError: (3, ‘unknown channel’)
and cat /var/log/messages | grep ssh | grep auth | grep trying gives:
2018-01-31T20:18:02+00:00 info twisted: [SSHService ssh-userauth on SSHServerTransport,1126,5.188.87.49] 0101 trying auth password
2018-01-31T20:30:02+00:00 info twisted: [SSHService ssh-userauth on SSHServerTransport,1145,5.188.87.49] 0101 trying auth password
2018-01-31T20:30:58+00:00 info twisted: [SSHService ssh-userauth on SSHServerTransport,1146,222.220.93.66] root trying auth password
2018-01-31T20:36:31+00:00 info twisted: [SSHService ssh-userauth on SSHServerTransport,1149,5.188.10.179] 0101 trying auth password
2018-01-31T20:42:03+00:00 info twisted: [SSHService ssh-userauth on SSHServerTransport,1153,5.188.87.49] 0101 trying auth password
2018-01-31T20:42:03+00:00 info twisted: [SSHService ssh-userauth on SSHServerTransport,1152,103.99.0.187] admin trying auth password
2018-01-31T21:09:53+00:00 info twisted: [SSHService ssh-userauth on SSHServerTransport,1162,5.196.76.41] user trying auth none
Which looks like suspicious activity?