A production server has port 22 (SSH) open to the internet with password authentication enabled. What are the specific security risks and recommended mitigations?

• A.Password authentication on SSH is secure as long as strong passwords are used
• B.The risk only exists if the server is running a vulnerable SSH version
• C.Internet-exposed SSH with passwords is subject to constant automated brute-force attacks from botnets. Mitigations: disable password auth (PasswordAuthentication no) and use key-based auth; restrict SSH access to specific IP ranges via firewall; use non-standard port or port knocking; implement fail2ban to block repeated failures; consider VPN or bastion host requirement for SSH access
• D.This only matters for public-facing web servers, not backend servers