https://help.ubuntu.com/community/PortKnocking

Port knocking, fail2ban, and non-standard SSH ports keep our bastion SSH servers nearly completely secure. The only thing you can do is rotate your port knocking sequence, but that's some pretty high-level infosec work.