Just a quick one on ports, changing them is a fantastic way to stop brute force attacks, and adding something like denyhosts reduces this even further. I used t

Just a quick one on ports, changing them is a fantastic way to stop brute force attacks, and adding something like denyhosts reduces this even further. I used to have a 1024+ port for my ssh until I found out that if a regular user has access to your box already, if they can cause the SSH daemon to die somehow they can spawn a new process on that port (as 1024+ ports can be used by non-root users) and capture your password. I know it's pretty tin foil hat of me but another layer is always good.