I created gofwd, a cross-platform TCP port forwarder with Duo 2FA and Geographic IP integration. Its use case is to help protect services when using a VPN is not possible. While it's use cases are limited, it works great for me when I need to connect to my home network.
The overall elegance of this solution is that no additional software is needed. As long as you are within your predefined geo-ip location, have your phone, and know your hostname/ip address (and port number), then you will be able to access your system remotely.
After starting it, everything becomes much calmer. Nice thing is, fail2ban can protect much more than SSH.
Combined with only allowing key based login, password is disabled.
It's for the Pi as that's the target audience but it should apply generally for OpenSSH.
There's also a sister post about improving your "first factor" for those still using passwords: https://2byt.es/post/totp2/
For those who, like me, are unfamiliar with the concept of a SSH tarpit, it's a technique consisting of inserting delays into SSH connection attempts.
Old HN discussion on Endlessh:
I'm guessing that the person you replied to is referring to the same.
There are scanners like shodan that will scan every single port you have now so moving it to a non-standard port doesn't stop all the attackers.
- Implement a firewall on your instances.
- Implement port knocking for sshd.
- Move sshd to a non standard port to avoid the nmap/bot noise.
- Only log successful logins.
- Any combination of the above.
There are pros and cons to each item so you would have to decide which combination is the most appropriate and least friction for your organization. If leaving the port exposed consider enforcing key based authentication and disabling password authentication. For high risk accounts such as monitoring accounts that use passwordless unrestricted sudo, you can even restrict what networks the keys are valid from.