One of the universities I know has a rather unique password policy. They issue shell accounts to all computing students with strong passwords that are unchangeable. It is done via the
passwd -n flag which sets the minimum number of days between password changes. A high enough number essentially means that the user will never be able to change his/her password.
The passwords are then sealed in an envelope which can be opened only by the student. Students are reminded to request a new password if the envelope's seal is broken.
When prompted on this unique practice, the university mentioned that many students in the past used a weak password and a number of accounts were compromised through brute force attacks.
Another university in a very small country simply uses a GeoIP filter to block out all brute force attempts.
Does anyone know of any other practice which can be used to protect a SSH service which is used by many inexperienced users?