From a pragmatic end-user perspective. 1) Disable passwords and only allow keys even for root with PermitRootLogin without-password 2) public-key authenticati

From a pragmatic end-user perspective. 1) Disable passwords and only allow keys even for root with PermitRootLogin without-password 2) public-key authentication has somewhat unexpected side effect of preventing MITM per this security consulting firm http://www.gremwell.com/ssh-mitm-public-key-authentication http://www.gremwell.com/ssh-mitm-public-key-authentication