@abcdw Why not put it behind something like Wireguard?
Personally, I use a VPN (an actual one, not a tunnel) to connect my machines. SSH doesn't even go on the public internet anymore.

@abcdw 22 equals to a selfhosted honeypot. The first thing you do is change the port, then redo all server keys and deny the use of outdated protocols via conf. Then create an ed25519 private key, password protected, and ssh is set up

@abcdw I use `sslh` to share 443 between ssh, https and, when I had it on, openvpn. It has support for a couple more protocols.

@abcdw on 22 unless not available, but in both case you will get bots trying to login. At first i used fail2ban but now i only accept connection with an sshkey

@abcdw just 22 with fail2ban

also have it set to increase in ban time every failed attempt

# initial ban time:
bantime = 1h
# incremental banning:
bantime.increment = true
# default factor (causes increment to double bantime):
bantime.factor = 1
# max banning time = 8 week:
bantime.maxtime = 8w

@abcdw why should I change the standard port? This brings no enhanced security, it only makes me forget my own server config 😀

Trust the math

@abcdw with sshguard enabled, that adds the failed login sources to an nftables ipset, or a pf table