This is sound advice and I've seen this in quite a few small multi-server environments. The only thing I'd say is that once you get to 5 - 10 servers you might

This is sound advice and I've seen this in quite a few small multi-server environments. The only thing I'd say is that once you get to 5 - 10 servers you might want to look at a VPN such as openVPN (http://www.openvpn.net/ http://www.openvpn.net/), at which point all your SSH services can run on their hidden networks. This makes a bigger difference as well if you have more than a few people accessing the boxes, and for purely remote-based businesses quite a few use this type of setup to host their 'internal' network tools like an intranet, file storage, internal wiki etc. If you have the cash and capability, I'd recommend an IPSEC VPN over OpenVPN (using something like a low-end Cisco ASA for example, but shop around - the point is to use dedicated hardware), but if you're starting out, OpenVPN is fine.