> Don't expose SSH to the entire internet [...] Yes, and that's what tools like tcp wrapper (or iptables) are there for. I use it to disallow whole networks fr

> Don't expose SSH to the entire internet [...] Yes, and that's what tools like tcp wrapper (or iptables) are there for. I use it to disallow whole networks from Brazil, China, etc so they don't even reach sshd to talk to it. Less log clutter, less to do for fail2ban if installed.