Hi

I started noticing some Root access attempts from two points that were obviously not attempts I'd made to log in. They came from 114-32-148-24.hinet-ip.hinet.net, 112.101.170.113, so naturally I added a rule to the incoming firewall to block connections from those IP.s

The login attempts continued and the rule seems to have done nothing against them.

Every day I see something similar to the below:
User root logged in via sshd 2017-07-20 14:10:39
Authentication failure for root via sshd from 114-32-148-24.hinet-ip.hinet.net 2017-07-20 14:10:39
Authentication failure for root via sshd from 112.101.170.113 2017-07-20 14:10:39
User root logged out via sshd 2017-07-20 14:10:39
User root logged in via sshd 2017-07-20 14:01:45


So I went in and disabled root login via SSH and have restarted the entire box. The login attempts and pattern remains unchanged.
If i try connect to the the box myself via SSH using Putty I get a "network error: connection refused" message.
I disabled root access in SSH server settings, by setting PermitRootLogin no in /etc/ssh/sshd_config and adding this line at the end to allow SSH from the local network.
Match Address 192.168.1.*,127.0.0.1 PermitRootLogin yes

Also if you see the attached SSH server screen shot you can see the SSH server is stopped and I am unable to start it from the web interface.

How is the root login still occurring and what can I do to block it?