It's probably already been said, but it can be said enough: Security through obscurity is valid for marginally increasing the total security margin, but relying

It's probably already been said, but it can be said enough: Security through obscurity is valid for marginally increasing the total security margin, but relying on any one practice or technique always smells like a dangerous approach. (Hence the hollistic practice of many overlapping features providing defence-in-depth.) Changing ports reduces the threat surface in limited but practical ways, however far more effective would be using secure port knocking (say fwknop with GPG and is also time-based). Secure port knocking and changing ports together would be perfectly valid. In fact, I have deployed these for openbsd jumpboxes guarding core infrastructure. So breaking in would require defeating fwknop with GPG and ssh. (If anything needs public auditing, it's GPG and SSH. VPN code also considering the logic often makes OpenSSL look simple. )