There's an additional trick possible to dissuade these types of attacks, but I'm not sure if everyone is up to that type of dedication. I once worked with an a

There's an additional trick possible to dissuade these types of attacks, but I'm not sure if everyone is up to that type of dedication. I once worked with an admin who would setup a script to enable SSH passthrough on the firewall (also OpenBSD) at a specific time of day, but never the same time. Once connected in the allowed window and he finished his business, he would reset the timer for another time of day (or perhaps several days to a week later if he's going to be away for a while). It's a bit like the timed bank vault where even the manager couldn't open it until the timer on the door allowed it.