I am interested and only allow SSH traffic from entering from a lan interface and not my outside public facing interface. I am noticiing random user accounts with the show users account. I see the ip address that it comes from. they only show being in for 2 and 3 seconds. I use the clear line vty command to kill the session but they come right back within seconds. When I look at the config there are two username/password commands that I've created. How is this occuring?
We do not have enough information to understand or to explain to you how this is happening. If you want to give us enough information to work with then we can try to provide explanation to you.
In the meantime I will give you 2 suggestions about things you can do to help control this (assuming that you have not already done them):
1) you can configure an access list (usually a standard access list is better for this than an extended access list) to control what addresses can establish remote access to the router. You assign the access list to the vty lines using the command access-class
2) you can use an access list applied inbound on the public facing interface to deny tcp any any eq 22.
Would this/could this be one of those situations where you could use the control plane to block it as well? Setting the control plane to only allow management on the internal interface?
*** Please rate all useful posts ***