[deanhills]

@deanhills

It absolutely doesn't matter which one you pick from this range. Automated bruteforce bots are only after default ports either way. Human hackers as said before will run a tool like nmap to scan for all open ports and will find out your SSH port anyway.

That's great news thanks very much @"Hidden Refuge".  Have just been working on it.  You wouldn't believe how clumsy I felt as I rarely use "vi" or "nano".  Eventually I gave up on "vi" and went for "nano".  I'll put down the steps in a tutorial - maybe you could critique the content as it may be a bit antiquated.

---

Well turns out HostUS has a security feature in its Breeze Panel where one can change one's port 22 number to a random number.  
https://hostus.us/panel.html

I couldn't fix VestaCP after I had changed the port number of my VPS from the command line.  Eventually I gave up and decided to reinstall the OS.  I then checked HostUS and found a much easier way to install a random port number. It's a standard security feature with their panel.  It was enormously easy to do.

Only bad luck was that I'd forgotten to back up a new blog I had been working on two days ago.  Darn!  Well I guess that's collateral damage.  I decided not to go into Websites for now, want to learn how to fix the security first - may have to reload the OS again during experimentation.  

I'll check in 24 hours to see what difference the new port will make.  If it is not enough I may go for the other suggestions in the HostUS Breeze Panel and work with keys as well.

---

Looks as though everything worked out well. I was able to change my port 22 to a random number. Next I created keys with Putty Gen and disabled SSH password authentication on my VPS. All of it is working well.

I had two bad login attempts immediately after I reinstalled my OS, but after I changed the port 22 to a different number I haven't had a single bad login after that.