SSH is secure enough to not worry about attacks on port 22, right?
After connecting one machine to the SSH server is there a setting in sshd-config or SSH-config files that needs to be changed after creating a key?
Moving sshd to another port is simply security through obscurity. A better approach is to create a layered defense. Start by disabling password authentication and restricting the user list that can login via ssh. Then restrict the source IPs or networks that can connect, and put a throttling rule in place. Make sure that you log failed attempts and inspect your logs regularly. It's even better if you can alert on brute force attacks. There are quite a few tools that can do this.
If you can spare a server to use as a bastion host, then you can remove direct ssh access to your servers, and force all of your clients through one host that you can monitor. Once a client successfully logs in, you can restrict where they jump to by adding outbound iptables rules that are restricted by user or group.
If you disable password authentication, then you're in pretty good shape. If you allow it, use fail2ban to stop brute force password hacks. You will get them on an open ssh port.
If you disable passwords that should be fine. You can also restrict user accounts in the sshd_config file.
MaxStartups 3:60:8 AllowUsers myaccount
As a further restriction. you can also restrict hosts that can connect, but you might not want to do that.
The MaxStartups is my attempt at a simple form of connection "tarpitting", but I'm not sure how well it works.
With regard to brute force attacks, here is a simple rule to set up with Iptables:
# we create a new chain for bruteforce attack detection iptables -N BRUTE # allow 10 new connections in a timeframe of 60 seconds iptables -A BRUTE -m recent --set --name CHECK --rsource iptables -A BRUTE -m recent --update --seconds 60 --hitcount 10 \ --name BRUTE --rsource -j DROP # add a rule in the INPUT chain to check for SSH against the BRUTE chain iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j BRUTE
This works with the Iptables module "ipt_recent," which actually stores a file within "/proc/net/ipt_recent/name" (in this case name is BRUTE).
These rules will allow new connections in a delay of one minute from the same IP, otherwise it will be blocked temporarily and the IP has to stop new connection attempts against the service. While it is very simple to set up unlike fail2ban it doesn't allow for a distinction between successful connections and failed attempts.