The default sshd config is more permissive than it needs to be. These settings, applied in order, are the highest-value security changes I make.