Change: set default ssh port to 21322

Skyscape NAT rule changed for bastion.  Nothing else is externally
exposed.

Will also need to update fail2ban.
Fix: Remove bogus action for custom filter

The template renders the action inside a substitition, which is
invalid config.