I stick with iptables IP whitelists. We're talking /31 or /32 whitelists. I really don't need SSH access 24/7, so it's fine having just a couple chairs permitted. I don't need to SSH from the airport.
That's naturally not the only layer of security, but I figure it's a nicer option than non-default port.
That's naturally not the only layer of security, but I figure it's a nicer option than non-default port.