> Also ssh supports "from" stanza, which allows you to limit networks from where you can login. Additionally, sshd supports "Match", which can limit where any

> Also ssh supports "from" stanza, which allows you to limit networks from where you can login. Additionally, sshd supports "Match", which can limit where any or all of your users can log in from. There's also "AuthenticationMethods publickey", "PasswordAuthentication no", and "PermitRootLogin no", all of which one should also be using -- ideally, on top of (both host- and network-based) access lists / firewall rules preventing access to 22/TCP from everywhere except the hosts and/or networks you've explicitly permitted.