"Changing SSH port is security theater"

"Changing SSH port is security theater"
The purists love saying this. They're wrong about what it's for. It's not encryption — it's noise reduction. Moving off 22 drops automated scan attempts ~95%.
That matters: clean auth logs mean fail2ban and your alerts actually surface real targeted attacks instead of drowning in bot spray.
Port 2202 + key-only auth + AllowUsers deploy.
Defense in depth isn't theater. Quieter logs = sharper eyes. Try it tonight.