How do you harden a bastion host?

How to secure and strengthen the ssh server on the fortress host? If you don't want your staff to have access to the SSH Port, enable a firewalls and block all access to it. Don't use direct root login. Password basedAuthentication can be disabled and only Key basedAuthentication can be enabled in the sshd configuration file. Allow key based verification.