fail2ban after moving ssh off 22, and why both

Moving the port dropped the log noise by about 99%, which is the argument for doing it and not an argument for stopping there.

authentication failures per day, one host:

  port 22, no fail2ban      41,208
  port 22, fail2ban            902
  port 2202, no fail2ban        14
  port 2202, fail2ban            0

the 14 are the interesting number: somebody scanned the
full range and found it. it took nine days.

A non-standard port is obscurity and obscurity removes the background noise, which is genuinely valuable because it makes the remaining events readable. It does not remove a targeted attempt, and fourteen a day from a scanner that enumerated the range is exactly what the ban list is for. Key-only authentication is what actually secures the thing; the other two make the logs useful.