Choosing to only bind SSH to a VPN interface is another option.  If you can utilize a VPN that incorporates 2FA then that&#x27;s even better.  Projects such as zerotier are going a long way towards making this kind of thing easier to setup.