Interesting. This doesn't sound like that much of a vulnerability itself, but it does help clarify my thinking about SSH security. Basically, SSH with proper c

Interesting. This doesn't sound like that much of a vulnerability itself, but it does help clarify my thinking about SSH security. Basically, SSH with proper configuration banning password auth is just fine and okay to be exposed to the internet. Extra logs from some failed attempts aren't really a big deal. If you want to make access more secure for it, that's okay, but I'd resist using complex on-server software for that which is likely to be less battle-tested and expose more attack surface. If you must do so, do things that are simple and/or off-server, like run on an alternate port or block network access for control ports at the firewall or security group level from any IP range but the ones you expect to be connecting from.