I want to rid myself of the privacy sucking fools too. But man I still have a sweet spot for duo even though Cisco bought them. If you self host you really want to block root from ssh, use keylogin and mfa that sucker! Only a few seconds live before the cast of characters came knocking!