What is "deny mach-per-user-lookup"

Question

I went to console to investigate system crashes (i believe to be an openGL issue unrelated to this) and i saw a number of these:
5/26/10 1:22:42 AM sandboxd[330] sshd(1056) deny mach-per-user-lookup
There were 883 messages over 8.5 hours, mixed in with occasional:
Allow sshd-keygen-wrapper connecting from 217.27.150.178:55936 to port 22 proto=6
I traced the IP back to Kiev… in Russia. That's odd. I did a search around and found mention of people with snow leopard, 10.6.2 or 3 (which i have) reporting this but the conversations were varied…
could someone explain 'deny mach-per-user-lookup' for me, and elaborate on the sshd attempts? I don't know if i should be concerned. I do have an RSA key-only tunnel set up with my work computer, but i had believed this was to be the most secure set up possible and these seem to be on port 22 which is common FTP anyway. OS firewall is up otherwise allowing the common connections like fire sharing and SHH, my router is set for 'inbound and outbound accept' as its security policy, but regardless, all but a couple dozen specific ports are blocked.
Thanks for any input—

Answer 1

Nmap scan report for 217.27.150.178.sitel.com.ua (217.27.150.178)
Host is up (0.24s latency).
Not shown: 89 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
80/tcp open http
110/tcp open pop3
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
1720/tcp filtered H.323/Q.931
3128/tcp open squid-http
3306/tcp filtered mysql
From the scan, it appears to be some sort of server, possibly a private proxy server.
Perhaps someone is using it to anonymously attempt connecting to your machine.
Unless you are running a server, I say you need to beef up your security a bit. Close up
some of those ports you have opened up to the Internet.