I take a look at why leaving SSH password authentication enabled is risky, and why key-based auth with passwords disabled is a sensible setup for any internet-facing server. While reviewing server logs, I noticed sshd timeouts and suspicious kex_exchange_identification messages, and traced the IP address to a host in China flagged by others for brute force attacks...
