Nice analysis.<p>[advice for those not doing it right]: if your sshd config allows id/pw login, turn this off and only use kays.  Also, move your sshd listener port to something besides 22 to eliminate most of the bot login attempts in your log files.