How to enable SSH on Ubuntu and Debian (and Windows 11)

• An Ubuntu machine (24.04, 22.04 or another current release, desktop or server) or a Debian one.
• A user that can use sudo. On a fresh Debian install without sudo, run the commands as root instead (su -).
• Its address on your network. hostname -I on that machine prints it.
• Another computer to connect from. Linux, macOS and Windows 10 and 11 all include the ssh command.

1. 1

   Step 1: Update the package list

   Open a terminal (Ctrl+Alt+T on Ubuntu Desktop) and run sudo apt update.

2. 2

   Step 2: Install the SSH server

   Run sudo apt install openssh-server and answer Y. If apt says it's already the newest version, the server was installed already (Ubuntu Server usually has it).

3. 3

   Step 3: Check that it's running

   Run sudo systemctl status ssh and look for active (running). Press q to leave.

   On Ubuntu 24.04 it may say inactive with TriggeredBy: ssh.socket until someone connects. That's normal: systemd listens on port 22 and starts the server on the first connection. sudo systemctl status ssh.socket should say active (listening). If neither is running, start SSH and have it start at boot with sudo systemctl enable --now ssh.

4. 4

   Step 4: Let SSH through the firewall

   sudo ufw status shows whether Ubuntu's firewall is on. If it's active, run sudo ufw allow OpenSSH. If you turn ufw on later, add that rule first, or you'll lock yourself out of a machine you reach over SSH.

5. 5

   Step 5: Connect from another computer

   In a terminal on Linux or macOS, or PowerShell on Windows, run ssh yourname@192.168.1.20 with your user name and the machine's address. The first time, ssh shows the server's key fingerprint: compare it with the output of ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub on the Ubuntu machine, and type yes only if they match. Then enter your password.

Debian uses the same package and service name as Ubuntu: apt install openssh-server, then systemctl status ssh. If you ticked SSH server in the Debian installer's software selection, it's already running. Debian doesn't install ufw by default; if you use a firewall, allow TCP port 22 in it.

Fedora, RHEL, Rocky Linux and AlmaLinux call the service sshd and use firewalld:

sudo dnf install openssh-server
sudo systemctl enable --now sshd
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

On other distributions, install the package your distribution names for the SSH server, then sudo systemctl enable --now sshd (or ssh, whichever unit exists).

Four quick checks, from the machine itself and from the computer you connect from:

# on the server: the service, and what listens on port 22
sudo systemctl status ssh        # sshd on Fedora, RHEL and Arch
sudo ss -tln | grep ':22 '
sudo journalctl -u ssh -n 50     # recent sign-ins and errors

# from another Linux or Mac computer
nc -zv 192.168.1.20 22

# from Windows PowerShell
Test-NetConnection 192.168.1.20 -Port 22

Connection refused means nothing is listening on that port, or a firewall rejects it: check the service and ufw. Connection timed out usually means a firewall drops the connection or the address is wrong. Running ssh -v yourname@address shows where the connection stops. The help article on servers that won't connect goes through the usual causes. An Unable to negotiate error from an older machine or device has its own fix: no matching host key type found.

The server's settings are in /etc/ssh/sshd_config and the files in /etc/ssh/sshd_config.d/. After a change, check the files for mistakes, then restart:

sudo sshd -t                        # no output means the settings are valid
sudo systemctl restart ssh          # Ubuntu and Debian
sudo systemctl restart sshd         # Fedora, RHEL and Arch

Restarting doesn't close the sessions already open, but keep one open anyway while you test a new connection, so a mistake can't lock you out. If sshd -t complains that the privilege separation directory is missing, run sudo mkdir -p /run/sshd and try again. On Ubuntu 22.10 and later, a change to Port or ListenAddress also needs sudo systemctl daemon-reload and sudo systemctl restart ssh.socket, because the socket is what listens.

• Sign in with a key instead of a password, then turn password sign-in off. The passwordless SSH guide covers both.
• Keep the system updated (sudo apt update && sudo apt upgrade): SSH server fixes arrive that way.
• Leave root sign-in off. Ubuntu already refuses root passwords over SSH (PermitRootLogin prohibit-password).
• Don't forward port 22 on your router unless you need to. Moving SSH to another port only cuts down the noise from automated attempts.

Windows 10 and 11 come with the ssh command, but the server part is an optional feature you add yourself:

1. 1

   Step 1: Add OpenSSH Server

   Open Settings > System > Optional features, click View features, search for OpenSSH Server, tick it and add it. (On Windows 10 it's under Apps > Apps & features > Optional features > Add a feature.) Or, in PowerShell as administrator: Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

2. 2

   Step 2: Start it, and start it with Windows

   Start-Service sshd
   Set-Service -Name sshd -StartupType Automatic

3. 3

   Step 3: Check the firewall rule

   Installing the server adds an inbound rule for TCP port 22. Check it's there and enabled:

   Get-NetFirewallRule -Name *OpenSSH-Server* | Select-Object Name, Enabled

4. 4

   Step 4: Connect

   From another computer, ssh yourname@pc-address with a Windows account on that PC and its password. You get Command Prompt by default; type powershell to switch.

The Windows server's settings are in C:\ProgramData\ssh\sshd_config; after a change, run Restart-Service sshd in PowerShell as administrator. Keys for accounts in the Administrators group go in C:\ProgramData\ssh\administrators_authorized_keys rather than the user's own folder: see setting up SSH keys.

Once SSH is on, you can keep the machine in a saved list rather than remembering addresses. The RemoteAccessApp SSH client is part of the free Console for Windows and Linux:

1. 1

   Step 1: Add the machine as a host

   Download RemoteAccessApp and open the Console. On Connections, click Add host, pick SSH, and enter the address, the port (22) and your user name.

2. 2

   Step 2: Check the key and sign in

   The first time, it shows the server's key fingerprint for you to compare and trust, before any password is sent. Then it opens a terminal tab; Files opens the same machine in a two-pane SFTP file manager.

3. 3

   Step 3: Reach it when you're away, without opening a port

   If one of your PCs with RemoteAccessApp is on the same network, edit the host and, under Advanced > Network, choose Through a PC. The connection then goes through that PC, so nothing has to be forwarded on your router. See connect through one of your PCs.

It's free for up to 5 saved hosts. Next steps: save shortcuts in your SSH config file and copy files with SFTP.