Fair enough. I had an employer many years ago (~12) who insisted in spite of my objections that all of our servers be accessible via ssh (as root! On port 22!) with a shared, 7 character password on the public internet. Worst of all it was an (very small, working with other small businesses) IT consulting company, and my boss insisted on the same thing for client servers.

Needless to say, a number of boxes, both our own and belonging to our clients) ended up as C&C machines for various botnets and I learned a very valuable lesson about how to treat a machine serving ssh to the public internet (namely: don't listen to a boss who doesn't know wtf they're talking about with regards to security, don't allow password ssh logins _ever_, for fuck's sake don't serve ssh to the public internet if you don't absolutely have to, and bloody hell denyhosts!).

The headaches of dealing with pwned machines that were critical to the business in question while I was being paid 30k/year very much colored my opinion of how to handle ssh.

Obviously I quit that job as soon as I had a credible alternative and was able to double my salary twice in two years (amazing what you can do once you know what you're actually worth on the market).

I'm primarily a developer now, but do share some infrastructure management responsibility at the small (9 person) startup where I work now. Aws and opsworks has enabled us to run without a dedicated ops team, and I'm the most security paranoid person on the engineering team.