Its easier to go the VPN route than port knocking, but the vpn then ssh is too tinfoil hat for even my taste. As someone else mentioned, just run it on another

Its easier to go the VPN route than port knocking, but the vpn then ssh is too tinfoil hat for even my taste. As someone else mentioned, just run it on another port than 22, like 53 or 109, and youll get 99% less brute forcing attempts, and dont use passwords as those in the list, and disable user root to authenticate at all. If you're still paranoid about the minor brute forcing attempts left then add the iptables rule to limit connection attempts to 1/min. You're still paranoid? For what really? Port knocking wont help out at this level of paranoia. Hrm, security awareness. Its just not worth the hassle. If you already have OpenVPN setup, then its easy to put the ssh to listen only on the tun interface the vpn server has opened.