If you're putting sshd on its standard port available to the Internet, why are you allowing password-based auth?