Should i be worrried about this?

Yes, hackers are trying to break into your server.

Is it normal?

Unfortunately yes. Most computers exposed to the web are scanned on the SSH and other vulnerable ports like FTP several times a day. As soon as a hacker has found a port that responds he'll try to break in. Some do it manual, others with a script with a dictionary attack, but the game is the same: try combinations of usernames and passwords to login.

There are several ways to protect yourself against this:

• Use /etc/hosts.allow to limit the IP addresses that your SSHD server will respond to to your own IP address or address range
• Use a script that blocks access to the SSH port for a certain time when more than X failed login attempts have been detected (I use fail2ban, but there are others)
• Use a certificate as an extra authentication layer besides your password
• Block SSH access for all user accounts (including root!), except for some difficult to guess username. Always login with this difficult username and use su or sudo if you need to do something with root privileges.
• Use another port for your SSHD server than the default port 22.