I like some mix of the following:

- disable passworded logins (only keys)

- ssh bastion host

- decoy ssh honeypot on port 22 (http://www.plainlystated.com/2013/02/ssh-honeypots-dataviz/)