Combining 2FA, pub key and LUKS
You can improve the security of your SSH servers a lot by combining
2FA services (such as Google Authenticator) with public key authentication. This will certainly render bruteforce attacks useless. Make sure you store your private keys on LUKSencrypted devices and have a strong passphrase to unlock them.