authentication error for root

If the attacking IP address - as shown in your log this is 43.229.53.61 is the same every single time, then you could set your firewall to block that IP address completely. You could also lookup the ISP for that address and report the attack to them and they may disconnect that customer.

Indeed a quick Google search seems to show that 43.229.53.61 is a notorious address and is located in Hong Kong and that the ISP is Hot Net Limited.

See http://www.abuseipdb.com/report-history/43.229.53.61

You might want to think about setting up a VPN server. Then you can still allow HTTP access for everyone, but limit SSH access to only you and only via the VPN connection. This is not a complete cure as the scum out there will of course try to hack your VPN but it will help.

There is no point in manually blocking crackers, because the attempts could come from any of millions of addresses all over the world. You can use something like this:

http://www.sshguard.net/

Whenever an anonymous stranger asks you to download software from an Internet site be very wary, This can be an effective attack vector, if chosen with malicious intent or insufficient knowledge it can be used to cripple your Mac. Ensure that that the person who posts it leaves a method of contact for you to use in the event that something goes wrong, and always backup your Mac before running any downloaded software that claims to 'protect' your Mac.

Linc Davis wrote:

There is no point in manually blocking crackers, because the attempts could come from any of millions of addresses all over the world. You can use something like this:

http://www.sshguard.net/

Normally you would be absolutely right, however in this case there does appear to have been a prolonged period of attacks from the same single IP address as per http://www.abuseipdb.com/report-history/43.229.53.61 so in this case it might be worth trying.

I would also still recommend the use of a VPN server and not allowing SSH directly via the Internet. As a general principle one should only enable Internet access to the bare minimum needed of network ports and use a VPN for everything else. In this case I don't believe Internet access for SSH is needed and can be done instead via a VPN connection.

Then if the VPN goes down, you're locked out. I've had an SSH server exposed for years, and it must have logged hundreds of thousands of cracking attempts, not including those blocked by either sshGuard or the adaptive firewall. There's no danger as long as you don't allow password logins.

Nigel Gilbert wrote:

While in general I'm sure you are right to be cautious about accepting recommendations, in this case I haven't found any reason to be suspicious of sshguard, and note that it is available not only from its own web site, but also through Mac Ports and Homebrew. I have installed the Mac Ports version and will monitor it to see how it does.

It is not sshguard that you should be cautious of.