You can use keys to authenticate instead of passwords.

Disable root login and change the port. That's two of the best things you can do.

I'd do the following if your not using keys to login;

alter the servers ssh port
lock ssh access to admins static IP's only
create a sub user to ssh in
setup email alerts for any SSH login
of course utilise a strong password.

I hope this helps, good luck.

I prefer a random port and then disable root, and setup users, once a user is in, they can jump to root 'su root' I find this easier.
Then only allow access from our internal network

All good, then you need to crack more than one network.


All depends how you want to go