In order of least effort to most:

* Disable root logins (require su/sudo)

* Disable password logins (require public keys)

* Run Denyhosts, to block IP addresses that have too many repeated failed login attempts.

* Use Jumphosts (AKA Bastions). One (or a few) servers that listen to ssh from the open Internet and have no private keys stored on them (use key forwarding). All other servers only listen to ssh from an internal network interface the Jumphosts are also on, or from the Jumphosts IP address directly.