I don't close SSH. I just use port knocking on my firewall to enable the SSH.