> Use non-standard ports While I completely agree and encourage people to use all of your suggestions, this single step - not being on port 22 - has easily pro

> Use non-standard ports While I completely agree and encourage people to use all of your suggestions, this single step - not being on port 22 - has easily provided the most benefit. When sshd listened on port 22, I regularly saw attacks that would run through thousands of common passwords at high speed[1]. After moving to a random port, it was over a year before I saw another hostile login attempt. It may be easy to discover the server with a simple port scan, but in practice the attacks seem to focus on the easy targets. > fail2ban Fail2ban is great and highly configurable. I could accept having to manually reset occasional false positives, so my fail2ban will immediately (no retries) ban on the first use of anything that is known to be malicious such as any attempt to login as root with a password, asking to login with an account name like [admin, mysql, squid], or any apache access log matching /\/phpMyAdmin/, etc. [1] Several logins per second over ADSL could use a large fraction of the upload bandwidth.