Random addition: disable root SSH login, disallow password-based SSH login (switch to private key), maybe also add two-factor SSH authentication e.g. with a hardware key, or Google Authenticator or whatever.