SSH:
- Disable root login
- Disable password authentication
- Use sudo-based privilege separation
- Use public key authentication (ECDSA, Ed25519, etc...)
- (Optional) Store key on smartcard
- (Optional) Use a two-factor system such as Duo
- (Optional) Change port of SSH to non-default (this is security by obscurity, but it deters most automated attacks, although this shouldn't matter if you're using key-based auth).
Firewall: