I'm amazed that the easiest way to make brute force attacks useless isn't hardly ever mention. Simply disable password auth in your ssh server entirely and use ssh keys _only_.