Use keys, disable passwords
With your key working, create a drop-in file rather than editing the main configuration:
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
MaxAuthTries 3$ sshd -t && systemctl reload ssh # "sshd" on AlmaLinux/RockyKeep your current session open and test a new login in a second terminal before closing it. If anything goes wrong, the KVM console still gets you in.
Firewall
$ apt install ufw
$ ufw allow 22/tcp
$ ufw allow 443/tcp
$ ufw enableAutomatic security updates
$ apt install unattended-upgrades
$ dpkg-reconfigure -plow unattended-upgradesAdd fail2ban if you must keep password logins for another service.
