The moment a router port points at your server, every scanning bot on earth finds it within hours. SFTP can face that safely - SSH is built for hostile networks - but only after three defences are in place, not before.
Let the first option be said out loud: if the transfers can stay on the local network, or travel over a VPN your office already has, do that instead - a door nobody can find needs no guard. If remote staff genuinely must reach the server directly, then forward the port only after the checklist below is completely done. Partially done is the same as not done, because the scanners do not grade on effort.
Password login that was merely risky on a LAN is indefensible on the internet, where guessing runs at machine speed around the clock. Complete the key login guide in this series - every user on keys, PasswordAuthentication no verified from an outside connection - before the port forward exists. Also disable direct root login: the setting PermitRootLogin no removes the one account name every scanner tries first.
Fail2ban reads the login log and temporarily bans addresses that keep failing - turning a million guesses into a handful.
sudo apt install fail2ban/etc/fail2ban/jail.local with an [sshd] section containing enabled = true - editing jail.local, never the shipped jail.conf, so updates do not erase your settingssudo systemctl restart fail2bansudo fail2ban-client status sshdThe defaults already ban an address after a few failed logins for a cooling-off period, and repeat offenders earn longer bans. It is a seatbelt, not a wall - with keys only, the guesses it interrupts had no chance anyway, which is exactly the layered position you want.
An internet facing server runs public facing software, so its patch level is a security control, not housekeeping. Enable automatic security updates with sudo apt install unattended-upgrades and let it handle the SSH stack between your manual reviews. The exposed server you forget for a year is the one that ends up in someone else's botnet - set the updates, then set a monthly reminder to look at the logs and banned list from this guide.
See the whole Ubuntu SFTP setup done live, with the exact clicks and commands, in the Technical Anshu video.
Watch Full VideoTypically within hours, sometimes minutes. Automated scanning of the entire internet address space is continuous. This is normal and expected - it is why the defences go in before the forward, not after the first scare.
No, and the order matters. Keys make guessing futile; fail2ban merely reduces how much guessing reaches the door and keeps your logs readable. A password protected server with fail2ban is still one leaked or weak password away from entry.
Check the banned list with the status command from this guide, then unban their address with sudo fail2ban-client set sshd unbanip followed by the address. If it keeps happening, their client is probably retrying with a wrong saved password - fix the client, not the ban rules.