Stop hardening SSH the dumb way

Stop hardening SSH the dumb way

Moving SSH to port 2222 stops zero serious attackers and breaks your tooling. Do the two things that actually matter:

— PasswordAuthentication no (keys only, full stop)
— AllowUsers deploy (whitelist one user, root login dies)

Then put the box behind a firewall that only allows SSH from your IP: ufw allow from 1.2.3.4 to any port 22. That's it. Brute-force traffic literally can't reach the daemon. Skip the port-knocking cosplay. Try it tonight.