What to do (2)?
forbid connections from suspicious hosts
syslog to another node (with no user accounts)
logsurfer - look for multiple attempts
try to crack passwords regularly
change passwords regularly
avoid files, e.g. .netrc, with readable passwords