[mike_hock]

I certainly don't want to expose any more surface area than necessary to potential exploits by an attacker who hasn't authenticated successfully.

[chuckadams]

Yeah you're right, the screw-with-them-shell would have to be strictly a honeypot thing, with a custom-compiled ssh and all the usual guard rails around a honeypot. The password tarpit could stay, though script kiddie tools probably scale well enough now that it's not costing them much of anything.