A password with increased complexity is great, but if there is an exploit against the server software (OpenSSH or otherwise) that you're running, it won't help. The idea behind an obscure high port number is that it won't be attacked in the first place, but there are caveats to consider:
High ports introduce an additional security risk. If the SSH server goes down, a local user can stand up a new SSH server on the same port. Only ports 1-1024 are restricted to the root user, so your alternate port should be in that range. (This cuts both ways: port scanners only examine these ports, so you're less hidden.)
This is security through obscurity and should be considered "extra" but it should not be considered a part of the security when calculating entropy and risk. It's not bad to be obscure, but it is bad to assume that obscurity provides sufficient security. Adapting a quote from @barbecue:
Obscurity is to security as camouflage is to armor.
One makes it harder to find you, the other protects you once you have been found.
You might get fewer attacks on port 2938, but a weak password is a weak password.
I really like your idea of comparing the password entropy of
whatever2938 (*changed from
password2938 for reasons noted below), which I calculate to be 17 bits vs 30 bits, showing that the longer password is certainly more secure, but in order to model this properly, you'd have to get statistics on how many port-22-bound attackers would eventually break that longer password versus how many attackers that would both find the nonstandard port and break the shorter password, and even that analysis would have to assume the same rate of persistence even though attacks are increasing in both frequency and sophistication.
Instead, I'd recommend something like Fail2ban, which can recognize failed logins and ban the IP that attempted them (by default, Fail2ban blocks an IP for ten minutes after ten failed logins within ten minutes, but this is all configurable). This limits attacks to trying one password a minute, so
whatever would take about a week to break and even a more typical (yet still weak) password like
Da5id would take 12+ years (222.6 ÷ 365 ÷ 24 ÷ 60 = 12) of non-stop password checking, which is presumably enough time to get you to notice the attempts in the logs.
Do not think that this makes weak passwords like
Da5idRox a good idea. Fail2ban only runs on the SSH server; somebody with shell access would break this in two weeks.
Of course, there's nothing stopping you from doing it all. Add complexity to your password, use an alternate port, and block IPs with too many failures. An additional obfuscation technique you could try is port knocking, which can even be done securely if the knock itself is encrypted end-to-end or uses a one-time password.
* A minor note: I changed the question's sample passwords to use
whatever rather than
password is a special case. Common passwords like
password (and simple variations) are best assumed to an entropy around 0–5, so e.g.
p455w0rDz has an entropy of around 12, which is weaker than
L%. In the above math, I've instead assumed you meant a random dictionary word, which has an entropy of 17 bits). More on password complexity calculations.