Tor itself has a nice built-in method of authentication you can use. I don't know of a good howto, but it's documented in the man page. Search for "HiddenServiceAuthorizeClient": https://www.torproject.org/docs/tor-manual.html.en
It'd be pretty impossible to port-scan a .onion... I can't imagine one circuit lasting as long as you'd need to find some random SSH listener.
It's much harder to find than an IP on the Internet; I've never seen brute-force attacks coming from even a standard-port ssh hidden service.
Are you saying there is a complete directory of onion addresses?
There isn't a definitive/exhaustive directory, but see this post: http://donncha.is/2013/05/trawling-tor-hidden-services/
tl;dr it's possible, and you don't have to rely on crawling the web searching for .onion addresses. You can instead become a HS directory authority, and pick your place in the DHT. Eventually you'd be able to get every address that goes into the DHT.
So please, don't treat knowledge of the onion address itself as a secret! You still have to authenticate to your service in some way.