As pointed out by apsillers in the comment, what you are seeing are multiple TCP connections from the same IP address. If you group the source port numbers, you will be able to see that each connection is making a login attempt at a maximum rate of one per two seconds:
5967 Sep 7 11:50:20 .... sshd[13755]: Failed .... from 122.225.103.125 port 32582 ssh2
5966 Sep 7 11:50:19 .... sshd[13759]: Failed .... from 122.225.103.125 port 34328 ssh2
5969 Sep 7 11:50:21 .... sshd[13759]: Failed .... from 122.225.103.125 port 34328 ssh2
5968 Sep 7 11:50:20 .... sshd[13763]: Failed .... from 122.225.103.125 port 35381 ssh2
5970 Sep 7 11:50:22 .... sshd[13763]: Failed .... from 122.225.103.125 port 35381 ssh2
5972 Sep 7 11:50:24 .... sshd[13763]: Failed .... from 122.225.103.125 port 35381 ssh2
5971 Sep 7 11:50:24 .... sshd[13767]: Failed .... from 122.225.103.125 port 39706 ssh2
5974 Sep 7 11:50:26 .... sshd[13767]: Failed .... from 122.225.103.125 port 39706 ssh2
5976 Sep 7 11:50:28 .... sshd[13767]: Failed .... from 122.225.103.125 port 39706 ssh2
5980 Sep 7 11:50:31 .... sshd[13767]: Failed .... from 122.225.103.125 port 39706 ssh2
5984 Sep 7 11:50:34 .... sshd[13767]: Failed .... from 122.225.103.125 port 39706 ssh2
5987 Sep 7 11:50:36 .... sshd[13767]: Failed .... from 122.225.103.125 port 39706 ssh2
I think you should look at your PAM configuration settings in /etc/pam.d/sshd instead of /etc/pam.d/login. Also, from the man page of pam.d, it says:
optional
the success or failure of this module is only important if it is the only module in the stack associated with this service+type.
No, your IP address is not the only one targeted. It is an automated scan by several compromised computers mainly in China. This is a list of IPs targeting port 22 that I have collated in just a few days:
61.174.50.184
61.174.50.213
61.174.51.194
61.174.51.197
61.174.51.198
61.174.51.202
61.174.51.203
61.174.51.209
61.174.51.210
61.174.51.216
61.174.51.217
61.174.51.218
61.174.51.219
61.174.51.221
61.174.51.224
61.174.51.229
61.174.51.233
114.80.246.144
116.10.191.162
116.10.191.163
116.10.191.165
116.10.191.167
116.10.191.168
116.10.191.169
116.10.191.171
116.10.191.174
116.10.191.176
116.10.191.177
116.10.191.179
116.10.191.180
116.10.191.181
116.10.191.186
116.10.191.187
116.10.191.189
116.10.191.190
116.10.191.194
116.10.191.195
116.10.191.199
116.10.191.201
116.10.191.202
116.10.191.203
116.10.191.206
116.10.191.208
116.10.191.214
116.10.191.215
116.10.191.217
116.10.191.218
116.10.191.220
116.10.191.224
116.10.191.229
116.10.191.231
116.10.191.235
116.10.191.236
117.21.173.140
117.21.227.58
122.225.103.125
122.225.109.100
122.225.109.103
122.225.109.104
122.225.109.107
122.225.109.195
122.225.109.196
122.225.109.203
122.225.109.205
122.225.109.216
122.225.109.218
122.225.109.220
122.225.109.221
183.60.202.238
183.110.253.233
183.136.213.180
222.186.21.78
222.186.52.160
222.186.56.7
222.186.56.76
222.186.56.119
223.255.205.201
For you particular case, if you have the time to spare, you may like to contact Shengzhong Liu of WENZHOU GAOJIE TECHNOLOGY CO.LTD at +86-13738375522 to let him know that one of his computers is compromised. Alternately, you may consider switching ssh to another port and disabling root login to avoid the harassment.
