annoying brute force attack attempt using ssh

[jeff emminger]

isn't password authentication insecure?  why not set
"PasswordAuthentication no" and use ssh keys, and maybe port-knocking
too