Security through obscurity isn't bad, it's just not enough. I concur with other reports - just running an EC2 host for a couple of day you'll see login attempts

Security through obscurity isn't bad, it's just not enough. I concur with other reports - just running an EC2 host for a couple of day you'll see login attempts all the time on port 22. Just bots looking for low-hanging fruit. Something as simple as using port 2222 or 122 is going to avoid most of those scans and still be easy for authorized operators to remember. A targeted scan is still going to find it, but if there's some zero day and people just start scanning port 22 on all IPs, you're above much of the water. Still patch the zero-day ASAP, but the obscurity has probably bought you some time and decreased your real-world exposure to attempts.