With a well configured SSH server, 22=> 2222 is pointless, very much the definition of obscurity providing zero security.

OpenSSH is impeccably written software, widely battle-tested and its been literally forever since there was any significant vulnerability in it despite being one of the most widely deployed servers on the planet.

Enable key/cert only authentication and you are already effectively 100% secure.

Then, to double-down:

    - Harden KexAlgorithms and Ciphers
    - PermitRootLogin no
    - Compression delayed
    - PerSourceMaxStartups
    - PerSourceNetBlockSize

What part of "if there's a remote zero-day" you did not understand?

What part of how about you look at CVE and see its been YEARS/DECADES since the last severe vulnerability do you not understand ?

OpenSSH zero-day my ass .... if there were any, they would have been found and exploited by now.

OpenSSH is written by the same people as OpenBSD. Those guys are OBSESSIVE about writing secure and correct code and they have the track-record to prove it.

Fact is there are millions (billions ?) of OpenSSH servers out there exposed to the internet.

OpenSSH is not the way hackers are getting in my friend.

This is incredibly naive. Do you remember Heartbleed? Log4J?

These were major vulns in software that is widely used, heavily reviewed, deployed by MANGAs, etc.

Exactly.

I can't speak for Log4J as I have no experience, but I do know that anyone sensible agrees that OpenSSL is a pile of bloated dog poo.

OpenSSH, as I've already said, is written by the OpenBSD crew. They have a track record of having OCD about writing secure and correct software.

As I said mate, go look at CVE.

Its been YEARS/DECADES since the last serious vulnerability in OpenSSH.

That's despite being one of the most widely deployed pieces of software on the internet.

When an OpenSSH zero‐day gets released, you can bet your bottom dollar people will be scanning full port ranges for SSH servers. And only one of them has to find you.

If that’s the scenario you’re worried about, don’t rely on obscure ports. Run your sshd behind a VPN.

I know you're lying because it's not written in Rust.

/S

  Compression delayed

  Compression yes

With regards to

  PerSourceMaxStartups
  PerSourceNetBlockSize

You use it in conjunction with a third parameter that I forgot to mention, namely MaxStartups.

MaxStartups introduces a degree of randomness to the whole process, so you have MaxStartups X:Y:Z where:

     - X = Reference number of unauthenticated connections ("n")
     - Y = Percentage probability of dropping when n>X
     - Z = n=Z == all further unauthenticated connections dropped

Fun fact, MaxStartups/PerSourceMaxStartups/PerSourceNetBlockSize were specifically introduced >6.1 in order to add firepower to combatting unauthenticated connection DoS attacks.