Any Ubuntu server with port 22 open can start receiving SSH password guesses within minutes of going online. Here’s how to harden SSH using a configuration drop-in file, Ed25519 keys, ssh-audit, UFW, and Fail2Ban.
Run journalctl -u ssh on a cloud server after it has been online for a day, and you may find hundreds of failed login attempts targeting usernames such as admin and oracle and these automated scans are common on internet-facing servers.
Reducing the attack surface means disabling password-based authentication, tightening the SSH daemon configuration, and adding network-level protections.
This guide focuses on Ubuntu 26.04 LTS, with notes for Ubuntu 24.04 where behavior or configuration differs.