A fresh server is scanned within minutes of going online. The firewall is step one.
UFW
sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status verbosefail2ban
sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshdChanging the SSH port
A non-standard port cuts down the noise from automated scanners.
⚠️ Open the new port in the firewall before changing it, or you will lock yourself out.