You might also want to use:
AllowUsers user1 user2...
And it's probably best to disable password logins and use keys instead (http://www.google.com./search?hl=en&q=ssh+authorized_key...).
Re:Ask YC: Securing your servers?
by ghshephard on Monday March 24, 2008 @06:01AM
(#144454)
More important is to routinely rotate strong root passwords. What most people neglect to mention, when denying root access to an SSH server, is that people then login with a second account, (you still need ssh), and then su - to root. So, all you've really done is moved the difficultly in logging onto the server from the root account, to the secondary account+root account. Your security is now based on the strength of that bi-pair of passwords. As others have mentioned, moving logins to RSA keys (very easy) is probably a better approach.
In /etc/ssh/sshd_config, disable root logins:
PermitRootLogin no
Even if you think your password ist strong. This will stop a majority of the brute-force password-guessing attacks. For extra credit, install denyhosts as well. It has stopped a _lot_ of bad guys trying to brute-force my servers.