Harden access in the right order

First establish a named account with the permissions you need, install its public key and confirm key login plus sudo in a second session. Keep the current session open. Direct root access should be disabled only after the replacement route works.

Review the active sshd_config and included snippets; the first applicable value can win. The following is a key-only example. If a legitimate PAM or MFA design uses keyboard-interactive authentication, adjust that line for the design rather than disabling it blindly.

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
AllowUsers operator

Check the configuration before applying it. On Ubuntu the service is commonly named ssh; other distributions may use sshd. Reload only the unit that exists, then open another key-authenticated session. Keep a verified console route available.

sudo /usr/sbin/sshd -t
sudo systemctl reload ssh
ssh -i ~/.ssh/ombra_admin operator@192.0.2.20

A different port reduces some automated noise, but is not authentication. Before configuring port 22222, permit it in the guest and upstream firewalls. Socket-activated SSH can require a distribution-specific socket update. Verify the new listening address and a second connection before retiring port 22.

sudo ufw allow 22222/tcp
sudo ss -lntp
ssh -p 22222 -i ~/.ssh/ombra_admin operator@192.0.2.20

Limit source addresses where practical, review login events and maintain updates. Fail2ban can reduce repeated attempts when the correct log backend is configured. Check IPv6 as well as IPv4. Save the effective policy and console recovery procedure before closing the original session.