Port knocking + key-based auth... What more do you need?
I much prefer restricting port 22 to a few ip and disable passwords
http://www.cipherdyne.org/fwknop/docs/fwknop-tutorial.html#w...
It is only clear to the routers in your traceroute ... third party attackers cannot snoop on this traffic.
While port knocking is really just another layer of obscurity, obscurity works really well on scattershot/random attacks. An attacker dedicated to getting into your specific server is another matter but thankfully far more rare.
Thank you. Remember - security through only obscurity is a bad idea, but additional layers of obscurity can be very valuable.
Also remember: a typical port knock is a series of three ports that all have to be hit in a certain timeframe - for instance, 2000, 4000, 8000 - that's a big "keyspace" to brute force through at WAN packet speeds ...