How can I see a list of failed SSH logins?

Look at /var/log/secure.log

The sshd entries will tell you about ssh connection attempts, both successful as well as failures.

From an Applications -> Utilities -> Terminal session

cd /var/log

cat secure.log

If you are not Unix command line aware, then Applications -> Utilities -> Console -> /var/log -> secure.log

ls -laeO@ /private

ls -laeO@ /private/var

ls -laeO@ /private/var/log

ls -laeO@ /private/var/log/secure.log

Either the secure.log file is there, or something is missing along the way.

Also did you try the console app?

There would be no such file if there had been no valid ssh attempts.

OK. In Mountain Lion, they moved the secure.log entries into system.log

My mistake.

/var/log/system.log

contains the sshd messages in Mountain Lion. Lion, Snow Leopard, Leopard, Tiger, ... use /var/log/secure.log

I'm just putting 2+2 together to give guesses

'oracle' is the username the connection request was trying. The same with user 'test'

I do not have 'Bye Bye' entries, so maybe that is another username as it is followed by [preauth] which follows the 'oracle' and 'test' usernames. Or maybe it is something sshd is issuing. But again, I do not have any 'Bye Bye' entries in my logs.

Within hours of turning this on, I am getting attempts?

Is your Mac on a public network? Then you are getting random phishing attempts to connect to any IP address that can be found. I'm surprised you do not have any 'root' probes. 'oracle' I can undestand, as that it the user name to an Oracle Database, so getting access to a corporate Oracle Database could provide lots of information.

Drop Box is a new question. Please post a new thread about that, so you do not muddy up this discussion.

If you are directly connected to the internet (no home router between you and the ISP's broandband modem), then yes the world can see you.

Any no-password required access is open to the world. Now the world needs to guess your IP address has accessible accounts, but there are systems out there constantly probing IP addresses trying Well Known ports and Accounts attempting to find a "Live One". Not just ssh. File sharing, Screen Sharing, Web servers, FTP servers, etc...

If they think they have found a "Live One", they may come back and keep trying different passwords hoping to guess the password for an account. <https://www.grc.com/haystack.htm>