I always set up two things on all the servers that I am in charge of: fail2ban and disabling ssh password logins. There are still people who insist on having passwords and using them to access remote hosts, but thankfully there are fewer every year.

I also used to run http://www.symantec.com/connect/articles/slow-down-internet-... on some of my hosts. It was fun for a while but caused me to have one too many lockouts.