ssh spammed from 127.0.0.1 (“Did not receive identification string” and “Bad protocol version identification”)

Solution 1:

This looks a bit like some port scanning / exploit scanning activity that is performed against ngrok's network. The scanning packets are redirected via their tunnelling feature to your SSH port.

ngrok's network is actually a very good target for scanning activities like this, since their purpose is to expose development environments to Internet, and those are typically not properly secured.

However, in your case, this scanning isn't dangerous, as SSH doesn't have any known remotely exploitable vulnerabilities. It will simply fill your log, and might use some bandwidth.