I'm not sure your comment about the ability of a user to create a daemon on another port being the same regardless is correct: > He claims that you shouldn’t r

I'm not sure your comment about the ability of a user to create a daemon on another port being the same regardless is correct: > He claims that you shouldn’t run your SSH daemon on a non-privileged port because anyone can spin up a daemon up there. Great point, except you can still do that even if you run your main one on 22. ... surely the point here is that this is not an internal server (if it were, you wouldn't be getting tens of thousands of attacks in your example). So in the case of a server running on port 22, someone with user level access couldn't set up a daemon running on port 2222 because it wouldn't be allowed through the external firewall. Put ssh on 2222, and you just opened the firewall for a port any user can open. I agree with a lot of your other comments, though.