Seems to me that if you have users who might try this sort of think (and have the perms for it), you have a different issue.

Typically, I would run ssh on a variety of other ports for a very simple reason: our staff travels and more than occassionally encounters an interior network that is heavily firewalled. Port 80, perhaps port 443 and perhaps 8080 are all you can rreally rely on. However, having ssh running on some high ports, can also help.

Equally, what’s going to happen when your regular user ssh-es into your rouge users rouge port, and doesn’t get the same keyauth? Etc.

But surely– if you’re going to run ssh on a port > 1024, you should prevent your users from using the same port. Noted.

Typically this is reserved for servers that are running public facing services. If the machine is fully behind your firewall and you’re the only one that controls this firewall, I would not worry about it too much.

I don’t see any issue with non-standard ports at all. My point is that using non-priv’d ports (ports > 1024) is an unnecessary risk and no more ‘secure’ than 44444 or something, if that makes sense.