Also cut down on the host keys (e.g. don't have an RSA/DSA/ECDSA host key if all of your clients support Ed25519 hostkeys) and key exchange algorithms (KExAlgor

Also cut down on the host keys (e.g. don't have an RSA/DSA/ECDSA host key if all of your clients support Ed25519 hostkeys) and key exchange algorithms (KExAlgorithms in sshd_config); almost all clients support curve25519-sha256 now, so get rid of all the DH fixed ones. Similarly ciphers; OpenSSH and PuTTY support ChaPoly, so you can get rid of aes-ctr, et al. I'm not saying decrease your supported algorithms to the point where you break things you're using, but you'd be surprised at how much you can get away with not having and never notice it. At the end of the day this means all those horrible libssh bots and worms can't even begin an SSH session with you, much less attempt any sort of exploitation or bruteforcing. It still generates an entry in your logs (key exchange algorithm mismatch or the like), but decent syslog daemons can filter out such messages by regexps, and redirect them to another debugging log file that you hardly check unless you're having an issue connecting somewhere. Metalog is an example.