Hacker News Reader

So basically use fail2ban with e.g. 10 attempts and only allow key-based SSH-login and you are "safe"?

For sure on 2, though you ought to have fail2ban like capabilities closer to the perimeter, probably a combination that pushes the ban outwards

Even better for 2 is something like OS Login in the Google Cloud where you can also use 2FA / OTP