[spjallþráð]

Assuming you have SSH keys configured and are using keys securely, have performed some hardening of the host (Grsecurity, etc), and have blocked passwd login and root logins...

Bind SSH to an unprivileged port, bound to localhost only, and have it run with privilege separation.

Now, install Tor on the box. Configure Tor to act as a Hidden Service pointing at SSH, and configure Hidden Service Authentication (poorly documented, but it is one line in the config), so that your HS is only accessible to those with the pre-shared cookie in the first place.

Now you have effectively a second factor of authentication of sorts - SSH is only accessible at all over Tor, which provides end to end encryption and keeps it off the public internet, and the HS is only addressable if you have the pre-shared authorization cookie.

http://tor.stackexchange.com/questions/2...entication
https://www.torproject.org/docs/tor-manual.html.en