There are a few other posts on HN with the same title. Some things to also consider that I had not seen mentioned:
PCI
CIS
Etc…<p>Include many more things specifically around ssh that you can do outside of fail2ban, also things that are requirements for the above….<p>These posts are good but slightly miss a lot of security practices that are “standard”. As always the best security is not allowing the system to be connected to anything.
But in the event that you have to have a system with such availability, it’s always best to introduce at least CIS foundations and whatever you see fit for security. Just my .02..