iptables - close all ports and open ports only on specific networks/targets
fail2ban - securing all logins on webserver, mailserver, ssh, sftp, mysql, ...
move ssh port to get rid of port scanners
ssh keys - disable passwords
ssh port forwarding for non public services
use vpn for non public...