Or just use an alternate port. There are, what, 65533 alternate ports available? > Then privision a new box and try to ssh to it with port 22 blocked. Should

Or just use an alternate port. There are, what, 65533 alternate ports available? > Then privision a new box and try to ssh to it with port 22 blocked. Shouldn't be a problem if you've got your provisioning stuff set to configure ssh on an alternate port. > I could of course run fail2ban or a firewall rule in order to block at 3 failed attempts A good idea, but still an additional step beyond simply using a different port. > and still run on port 22 And you'll still end up on the receiving end of more malicious traffic than if you'd not used port 22. > Or use port knocking. Not necessarily a bad idea, but still far more complex than simply using a non-default port. Same reason that many ISPs (including Amazon) place more restrictions on port 25 than other ports commonly used for SMTP traffic.