The server version isn't visible anymore
About those ssh connections, I must say I have litterally millions of them in my logs. At first I tried to send e-mails here and there, but never got an answer. I learned later that they come from a big botnet class that exploit badly secured servers. Basically, it just scans for frequent accounts with default passwords (such as "john/johnpw"). Decently secured servers don't get exploited, but given the awesome number of connection attempts I found in my logs, I guess there are countless incompetent sysadmins roaming everywhere around the net
The best way to cope with those is to move the ssh port elsewhere (it seems you did, or at least you restricted it by IP address as I couldn't find it). Personnally I decided to let it on port 22, just to have some statitics; I never bothered to put a honeypot instead. To make sure none of them manage to login by pure chance, I put a smoke of screen:
1) root account is forbidden by ssh. It acts as if you could connect using root, accepting username and password, but invariably returns an access denied even if the password is correct. So all attempts on root are doomed from the beginning.
2) I set up a special account that is the only one that can connect from the outside
and is in the wheel group (it has no other purposes, and therefore holds no data and no privilege except the wheel group). Some other accounts are accessible from the outside, but aren't in the wheel group, making them useless for the root compromission. The username of the account is secret, similar to a (weak) password, making things even more difficult for a potential attacker. So far, none of the failed connection attempts tried the correct username, unless my own failed attempts.
I have no doubt that if, say, the FBI wanted to root my computer they might make their way to it (with a big "maybe" though). But otherwise it is simply not cost-effective for the standard botnet, which has anyway tons of badly-secured computers everywhere.
If you don't, someone wanting to attack you will just go for a search to pick an attack tailored for your exact web server version 
irate:
