I know everyone has there own opinion but I can't see how it is unsecure if sshd access is only allowed for vertain ips in the hosts.deny/hosts.allow files.
Surely having in hosts.deny sshd: all and in hosts.allow the ips that can access ssh then that would be more secure then allowing ssh access to anyone but just root access turned off?
That adds a great level of security. Perhaps too much; there are many circumstances under which you might unavoidably have to use a different IP# to contact a server.
Even if my IP changes then I can just ask another staff member to change my ip in hosts.allow file, or even use webmin to edit it on the rsync server and then all our boxes will update with the new ip that night.