Had a similar issue with tlp recently. I just happened to notice the laptop battery was at 100%, and said it was charging. I double and triple checked the config file, but the tlp-stat -b still showed the thresholds at 90%-100%.

Turns out tlp, at some point, started ignoring /etc/tlp.conf, and was pointing to /etc/default/tlp

This is good advice in general. Think of it like penetration testing. You really should verify what you can actually access remotely on a device and not assume you have any level of protection until you’ve tried it.

Log files can also contain signs of attack like password guessing. You should review these on a regular basis.

Good advice. One should always test, for correctness, not just infer.

OpenSSH right? What version?
No issues with Dropbear

Show your effective sshd server config: sudo sshd -T

/etc/ssh/ssh.d/

You mean /etc/ssh/sshd_config.d?

I could even go further into saying: always test every change you make, do not assume the change has been made because you updated a file.