I do agree but a lot of it depends on the business case. Sometimes the business requirements dictate you have password authentication enabled. :(
You're right that key only logins are the easiest quick win, but it's also worth remembering that they can still be vulnerable if the box needs passphraseless keys (eg lazy automation) or if you cannot guarantee the security of those keys (eg they're generated by third parties and/or stored on third party systems). In those situations it would pay to firewall SSH and specifically whitelist the third parties IP address.
Good suggestion about the logs too. That's an often forgotten step yet invaluable when it comes to forensics.
You're right that key only logins are the easiest quick win, but it's also worth remembering that they can still be vulnerable if the box needs passphraseless keys (eg lazy automation) or if you cannot guarantee the security of those keys (eg they're generated by third parties and/or stored on third party systems). In those situations it would pay to firewall SSH and specifically whitelist the third parties IP address.
Good suggestion about the logs too. That's an often forgotten step yet invaluable when it comes to forensics.