OTOH, not running on port 22 prevents you from drive by scans. You are right that it doesn't protect from a targeted attack. In my experience (10 years as a s

OTOH, not running on port 22 prevents you from drive by scans. You are right that it doesn't protect from a targeted attack. In my experience (10 years as a sysadmin and dev), I've never had a targeted attack -- all the attempts against my machines are drive by. Having port 22 open can end my IPs on a list of "let's try to break later". It's not close to a complete solution, but I find it beneficial.