"If you cannot restrict SSH to a static management-ip, use an alternate high port like 2222, this will prevent a lot of``hello mcfyl - someone in there""- knockers."
Use fail2ban/denyhosts to protect ssh from brute force attacks.