Secure an SSH Server

Sean writes...

I would love to hear the best policies and practices with ssh. Allan says it's best to not allow root login. I have heard of denyhost but don't understand how it's different than fail2ban. Should you limit ssh login to a particular ip address or netblock for additional precautions or would that be a mistake likely to cause issues? In Linux, how would you disable root ssh login?

Looking forward to the wisdom of Allan and Chris!