If you disable passwords sshd_config ...
then you'll get no script kiddie attacks.
With either enabled you get a chance to try a password .......
[stevea@crucibulum ~]$ ssh foobar@localhost
Permission denied, please try again.
Received disconnect from 127.0.0.1: 2: Too many authentication failures for foobar
Without BOTH set to "no" and only "PubkeyAuthentication yes"
[stevea@crucibulum ~]$ ssh stevea@localhost
Permission denied (publickey).
Even script kiddies aren't dumb enough to try to brute-force a key.
Rate limiting connection isn't a bad idea to avoid DoS generally. But you wont get the attampts when you ...