> Since 14:00 my logs (middle node) are spamed with around 100 faild > ssh login attemps from different ips. > Is there anybody else affected? Yes - it's constant 3-5 attempts per second - that's normal. Use some tool like fail2ban and/or ssh key authentication. Paul