The issue is that a SSH login attempt was even possible on the WAN interface, 22 is not supposed to be able accessible on the WAN because it is not open on the firewall. Password is 25 characters, randomly generated from KeePass. Anyhow, I removed login for root and setup the Ubuntu approach with a sudo user.