The other thing to consider is that obscurity makes threat detection easier. If your sshd_config is set up for some random port and you get 18K attempts, then i

The other thing to consider is that obscurity makes threat detection easier. If your sshd_config is set up for some random port and you get 18K attempts, then it's pretty clear that someone is interested in your server. If you're running it on port 22, then a slew of login attempts could be difficult to disambiguate from regular portscanning weather.