Sure, you could try to populate .ssh/config on every machine you ever will try to login from.
Or you could use the standard port, turn off passwords, and wait for the sun to burn out before someone brute forces their way in.
Or you could use the standard port, turn off passwords, and wait for the sun to burn out before someone brute forces their way in.
How do you ssh-copy-id without some allowance for passworded logins? Especially if you're doing it from such distant machines that you can't scp over a .ssh/config file.
Sure, I could have puppet push a ~/.ssh/config file everywhere, just seems more effort than it's worth. After all if a hacker wants to know if you are running ssh, it's not hard to scan all ports for ssh.
Why inconvenience yourself more than the attacker?