[cpach]

As others have pointed out, disabling password-based logins for sshd is a must.

You can also go further if you like: Put the sshd service behind WireGuard (or spiped). Then malicious actors will never find your SSH ports.