General good-practice question:
If I set up public key, passwordless authentication (say, between laptop client and desktop server... laptop may log in from home network, or out and about through the router port forwarding), is this best done for a non-superuser account? This makes sense to me, as I could always "su" into an admin account after logging in, and should someone succeed in logging in unauthorized, they would have less privileges than a superuser (I realize that the sudo password is still necessary for lots of things, even if logged in as superuser... still would rather insulate the superuser's 'user files'). Is this a good practice? Is there a good reason to log in remotely as superuser, or is it better to log in as a regular account and then "su" as needed?
Should I make a user specifically for the purpose of SSH login?
Another question: I've installed OpenSSH and edited the config to allow only a certain user, only RSA key authentication, changed default ports, etc... is there a way to ensure that the vanilla-default SSH daemon is no longer running? I'm concerned its possible to be using some awesome OpenSSH config, while the old default daemon is still accepting requests on good ol' port 22. Does installing OpenSSH sort of "disengage" the default daemon? I guess the way my router is doing port forwarding, it should disallow forwarding of port 22, but it would also be good to get each machine squared away as far as what ports its actually using (not leaving unused services/ports open).
Final question: If there are multiple machines on my home network, and I might want to SSH into more than one of them (and they are set to listen on different ports), is specifying router-ip:portnumber the only way to select between the machines (the router has one external IP)? Is this bad practice, and should I generally SSH into a "gateway machine" which then SSHs into other machines? I guess that way the router would have to only forward one port, and I could control access by specifying valid user accounts?
I'm using Ubuntu 12 and above, but I imagine the answers to these questions are not OS-dependent.