> moving ssh to a non-standard port number +1. If/when there's an sshd remote exploit/worm, it will probably only scan port 22. "AllowUsers" is good too. And

> moving ssh to a non-standard port number +1. If/when there's an sshd remote exploit/worm, it will probably only scan port 22. "AllowUsers" is good too. And, port knocking if you don't mind the hassle.