well, sshd denying requests isn't a performance cost, in itself. But having a script like denyhosts or fail2ban that analyzes auth logs for IPs to block requir

well, sshd denying requests isn't a performance cost, in itself. But having a script like denyhosts or fail2ban that analyzes auth logs for IPs to block requires memory for the interpreter running the script, as well as however much of the log gets read into memory. Blocking external ssh connections can avoid that performance hit, however large or small it ends up being.