I don't think changing the SSH port is bad, at least it avoid some spam in the logs from all the automated login attempts. But for SSH there is a single, obviou

I don't think changing the SSH port is bad, at least it avoid some spam in the logs from all the automated login attempts. But for SSH there is a single, obvious security measure you should always take if at all possible, and that is to disallow passwords and use public key authentication exclusively. Weak passwords are the biggest danger for SSH, and this solved this specific problem entirely.