Which of the following is considered a best practice for hardening SSHD?

While port knocking can add a layer of obfuscation, it's generally considered less robust and more complex than simply disabling direct root login and is not the primary best practice for *root* access itself.

Completely disabling SSH access would prevent remote administration entirely, which is impractical for most server environments and defeats the purpose of securing SSH.

Disabling direct SSH login for the `root` user (`PermitRootLogin no` in `sshd_config`) is a strong security best practice. This forces administrators to log in as a regular user first and then use `su` or `sudo` to gain root privileges, adding an extra layer of authentication and reducing the attack surface against the highly privileged root account.

Renaming the `root` user is generally not recommended as it can break system utilities and expectations about the `root` account, causing more problems than it solves.