When allowing SSH-access for customers, it would be nice to block access from all IP-addresses by default but let every customer define his IP address from which he needs access to the server. Enhance can then add allow access from that IP address to the UFW firewall and block everything else. Of course the administrator should also define the required IP addresses to not loose access himelf.
This way the SSH port is only accessible for a limited set of machines which improves security in my opinion.
