On: Is it normal to get hundreds of break-in attempts ...

[seiji]

At times, a few hundred per minute is "normal."

I prefer port knocking or two factor auth as a solution to brute force attacks. http://code.google.com/p/google-authenticator/

[lsc → seiji]

eh, disabling password auth solves the problem almost as well.