You are totally right, and it seems non-trivial to work around this. One approach would be to whitelist an IP upon successful logon. Perhaps by modifying /etc/s

You are totally right, and it seems non-trivial to work around this. One approach would be to whitelist an IP upon successful logon. Perhaps by modifying /etc/ssh/sshrc to invoke iptables (though this is not executed as root...). An alternative would be to use pam_exec and have that invoke iptables to whitelist the IP (assuming it can find out the IP). But I don't think PAM is even used if SSH private key authentication is used...