Comment by wrkronmiller

I usually just disable password auth and update regularly, when I have an SSH server open to the internet.

Short of an 0day in the SSH service, I expect brute forcing the private key(s) to take longer than I have years to live.