Port forwarding opens an attack surface- whatever service you're exposing is the "attack surface" so make sure it's secure.
disabling password login
This is absolutely a very strong/good hardening first-step.
pubkey authentication
Hell yeah. Very strong. Just keep that key safe (don't post it on the Internet, put it somewhere insecure or public, etc. Also recommended to password protect the key for extra safety.
Additional steps you could take if you were worried: two-factor authentication, usually easy to setup and effective. Fail2ban or other IP blockers, takes more work and setup. Rate-limiting is a basic feature most ssh services have (e.g. more than 3 failed attempts = 5 minute lockout).
Port forwarding opens an attack surface- whatever service you're exposing is the "attack surface" so make sure it's secure.
This is absolutely a very strong/good hardening first-step.
Hell yeah. Very strong. Just keep that key safe (don't post it on the Internet, put it somewhere insecure or public, etc. Also recommended to password protect the key for extra safety.
Additional steps you could take if you were worried: two-factor authentication, usually easy to setup and effective. Fail2ban or other IP blockers, takes more work and setup. Rate-limiting is a basic feature most ssh services have (e.g. more than 3 failed attempts = 5 minute lockout).
But honestly keys-only, IMHO, is the safest ๐