Disabling password auth is the single highest-value line in sshd_config

A server on a public IP receives thousands of password attempts a day, and fail2ban reduces the rate rather than the risk. Turning the mechanism off removes it.

# /etc/ssh/sshd_config
PasswordAuthentication no
ChallengeResponseAuthentication no
PermitRootLogin prohibit-password
AuthenticationMethods publickey

# and verify BEFORE closing the session that opened:
# ssh -o PreferredAuthentications=password host   → should be refused

Testing from a second terminal before logging out of the first is the discipline that avoids locking yourself out of a remote machine, and it is worth doing every single time regardless of confidence. PermitRootLogin prohibit-password allows key-based root for automation while refusing passwords, which is the pragmatic middle setting. Cloud providers frequently override this in a file under sshd_config.d, so checking the effective configuration with sshd -T is worth the extra command.