New answers tagged zero-day
I honestly can't believe any of the previous posters have told you the obvious answer. Both of the above answers are WRONG.... you don't need port knocking, you don't need to change your port, you don't need to set up IP filters.... unless you really want to do "belt and braces". All you need to do is do what most people are too lazy to do .... (a) ...
OpenSSH provides a very good initial security, because it uses privilege separation and sandboxing. This way the small network listen and authentication part is separated from the rest, that is, it runs as a different non-privileged user and with sandboxing it also can do only limited system calls. The major problem then is brute-force password probing. The ...
Setup a port knock daemon which opens the firewall for some time when specific ports are "touched" in some specific order. See for more information Port knocking
Setup IP filters on your firewall or server, so that SSH connections are only accepted from a specific static IP. That will at least force an attacker to compromise your client or your network infrastructure, before they can use a 0-day attack against your SSH server.
Top 50 recent answers are included