With a well configured SSH server, 22=> 2222 is pointless, very much the definition of obscurity providing zero security.
OpenSSH is impeccably written software, widely battle-tested and its been literally forever since there was any significant vulnerability in it despite being one of the most widely deployed servers on the planet.
Enable key/cert only authentication and you are already effectively 100% secure.
Then, to double-down:
- Harden KexAlgorithms and Ciphers
- PermitRootLogin no
- Compression delayed
- PerSourceMaxStartups
- PerSourceNetBlockSize
With a well configured SSH server, 22=> 2222 is pointless, very much the definition of obscurity providing zero security.
OpenSSH is impeccably written software, widely battle-tested and its been literally forever since there was any significant vulnerability in it despite being one of the most widely deployed servers on the planet.
Enable key/cert only authentication and you are already effectively 100% secure.
Then, to double-down:
Job done.