I switched all my servers to ssh publickey login and disabled password login about a week ago (root login IS still enabled). I also run Fail2ban and logwatch.
Why is there still login attempts showing up in the logs? I admit the number of attempts is down to low double digits, but shouldn’t there basically be none? Are there bots actually trying to brute force a key that makes no sense? Or my guess I have something configured incorrectly?
Serves are Ubuntu 18.04 and Debian 10 both up to date.
EDIT: For future reference this question pertains more to the logging of login attempts then the security there of.