[Loki123]

4. Add 2 factor authentication

5. Change the default port. Not really "security" but it will reduce the number of people who try anything who just scan IP ranges for specific ports. I like 2222 personally.

6. If you really want to get creative you could look into "port knocking"

4. He has SSH keys. He doesn't really need more protection considering the authentication other than keeping the private SSH key safe and as well as using a good passphrase with it. Other than that, the authentication process is perfectly secure as it is. But as a further protection, it is correct to mention it.

5. Changing the port to 2222 should be considered a security risk really. I'll accept that he should be fine doing that, but he shouldn't do it none the less. The main risk I personally see if, on a multi user system, one user starts mimicking the SSH server he put in place. And yes, that user can do that because you changed the port to 2222. Now; Due to the SSH keys, he should get a key mismatch error and load of crap, but the risk still exists.

6. Port knocking is a much better solution. As it would keep the SSH server on a privileged port but then again; is there any real harm in showing that you are running an SSH server ? No, none at all.

If you want to reduce logs on SSH there are better methods and you listed one that comes into mind, Fail2Ban or quite simply using IPTables. Then, for the last part. Logs don't get that big, log files are usually split up when they reached some max size. Meaning, searching in them isn't very slow nor complicated if you can take advantage of grep for example.

The rest I completely agree with though.

@Megan

Take a look at Grsecurity but in my experience, security vulnerabilities are mostly due to the owner and maintainers incapability to reckon when his system is outdated. It is more rare to be compromised by a vulnerability that has not hit the internet yet or one that hasn't been patched yet. Security issues that are dangerous are usually fixed nearly right away and a patch pushed out. Keeping your system updated is crucial to being secure, however, that does not mean always be updating to the latest version or to the next stable major version, that could be a pain if major changes happened. What I mean is that you keep updating to get security patches. Stable versions more often than not get security patches so system administrators don't have to go through the trouble very often to update to a new major version each time they release a new one, instead they have the option of only getting the patch and not needing to maybe reconfigure their whole setup due to a syntax change or something important to them at that time being removed in a newer version. And a lot more probably that you can count up on the reasons major, stable, versions are kept supported for quite some time.