First: Apply all official patches via APT. That’s the most important thing. The easiest way to avoid getting pwned is to apply security patches without too long

First: Apply all official patches via APT. That’s the most important thing. The easiest way to avoid getting pwned is to apply security patches without too long delay. Then consider defense-in-depth. If you have sshd exposed to the Internet, you could put it behind a VPN such as Tailscale (or pure WireGuard). And FWIW: With our current knowledge, any LTS version of Ubuntu should not have been affected by this backdoor.