Hacker News Reader

Mandatory SSH keys mitigates the brute forcing risk, and turns it into a nuisance. My employer presently has this arrangement and has done so for a while. Bastions only get you in the door: different entrances for different environments, users keys are only propagated to the machines they need.

Roger that. I keep thinking of my customer support people as non-technical and for whom ssh keys, port forwarding & bastion hosts are way over their heads but your point is taken. There are other (cheaper!) ways to secure an internal network.

Disable login via password, install fail2ban to help with the extra overhead/traffic.

If you have ssh running anywhere, please disable password access. Use keys. It should come installed like that.