Question about blocks and block emails..

[scottl31]

Hi,
I seem to get thousands of emails like this informing me that some hacker has been blocked:

Time:     Sun Mar  3 21:19:28 2019 -0800
IP:       43.243.128.213 (CN/China/-)
Failures: 5 (sshd)
Interval: 3600 seconds
Blocked:  Permanent Block [LF_SSHD]

Log entries:

Mar  3 21:02:48 domain sshd[24568]: Invalid user builder from 43.243.128.213 port 49424
Mar  3 21:02:50 domain sshd[24568]: Failed password for invalid user builder from 43.243.128.213 port 49424 ssh2
Mar  3 21:13:23 domain sshd[24665]: Invalid user test from 43.243.128.213 port 42337
Mar  3 21:13:24 domain sshd[24665]: Failed password for invalid user test from 43.243.128.213 port 42337 ssh2
Mar  3 21:19:24 domain sshd[24764]: Invalid user zu from 43.243.128.213 port 53695

So these are my questions:

1. how do all these hackers find my system and how can I stop their attempts to access it?

2. If I can't stop them, it's nice that they are being blocked. But I really don't need an email for every single attempt. How can I stop the emails notifying me of every block?

Thanks!

[studio4host]

you should follow cwp security instructions which you get marked with RED color when you login to cwp saying that you need to change ssh port.

[scottl31]

Uh.. yeah. I have kind of ignored that because when I click into it, I can't figure out how to change it or what to change it to.

Any guidance on that would be very appreciated.

Also, any idea how to stop the emails for every block?

[kandalf]

I have exactly the same problem, at the moment I can't change the SSH port, there are any way to disable the blocked SSH connection?
The server send other types of notifications and I want to keep it but the SSH notifications are so many that I need to disable it.

[Igor S.]

You can stop the emails but there a very bad idea. I'd suggest to change the SSH port and checking every email.