Interesting.
I was pretty sure that I did not have to enable sshd on my recent installs (and indeed, it was already enabled due to the way I install my systems, but that isn’t the case for Workstation or KDE edition, and I learned a few things when I investigated that).
I was only pretty sure, but not 100%. So before I made the claim, I checked the documentation regarding default services. From there, I could see in the linked files that 90-default.preset enables sshd and 80-workstation.preset doesn’t contain anything about sshd. Because these were the only relevant files linked in the documentation, I concluded that my memory was accurate and sshd was active by default. In particular, I did not take a look at the other preset files in the same directory (that’s going to be relevant in a moment).
After your response, I did spin up a new VM and installed Fedora workstation. And indeed, systemctl status sshd showed it as disabled. Hmmm …
Turns out that there is another preset file deployed by the workstation and KDE variants, 81-desktop.preset, which disables sshd and takes effect before 90-default.preset. And I don’t have this file on my installations, probably because I don’t install Workstation or KDE edition, I use the Everything installer, select the default “Fedora Custom Operating System”, and then add “KDE Desktop” in the additional software list on the right, which I think corresponds to ‘kde-desktop’, not ‘kde-desktop-environment’. After that, I use Ansible for the remaining system configuration, and with this workflow it works over SSH right away.
In any case, once I ran systemctl start sshd.service in this test VM, I could connect via SSH, without having to change the firewall config, which a quick check on the command line confirmed:
lars@fedora:~$ firewall-cmd --get-active-zones
FedoraWorkstation (default)
interfaces: enp1s0
lars@fedora:~$ firewall-cmd --zone=FedoraWorkstation --list-services
dhcpv6-client samba-client ssh
TL;DR: We were both right, it turns out you need to sudo systemctl enable --now sshd.service in the default Workstation and KDE installations. But that’s it, after that SSH and SFTP work, without changes to the firewall config, without additional changes to authentication, and without having to set up SSH certificates (that claim was what triggered my response, I have yet to see any setup of SSH with certificates, and in small to medium-sized contexts, regular SSH key pairs have always been sufficient for my needs).