WardtermSSH client
EN
Download

How to enable SSH on a Raspberry Pi

SSH is off by default on Raspberry Pi OS. For a new card, turn on Enable SSH in Raspberry Pi Imager under Customisation, Remote Access. On a running Pi, run sudo raspi-config and choose Interface Options, then SSH. With no screen, create an empty file called ssh on the boot partition and restart.

Updated .

New SD card: use Raspberry Pi Imager

This is the method Raspberry Pi recommends for a headless setup, meaning no screen or keyboard. Before writing the card, set these in the customisation options:

  • Hostname: the name you will connect to, for example server gives server.local.
  • User: a username and password. In a headless setup these are your login.
  • Wi-Fi: the network name and password, unless the Pi is on Ethernet. Without this a headless Pi never joins the network.
  • Remote Access: turn on Enable SSH, then choose password or public key authentication.

Choose public key if you already have a key: paste the contents of your .pub file, never the private key. If you have none, generate one first. Menu names change between Imager versions: in Imager 1.8 the same settings are under Edit Settings, with SSH in the Services tab.

Raspberry Pi suggests Raspberry Pi OS Lite for a headless device, since it has no desktop to run.

Pi you can already use: raspi-config

sudo raspi-config

Choose Interface Options, then SSH, answer Yes, then Finish. To do it without the menu, for example in a script:

sudo raspi-config nonint do_ssh 0

Here 0 means enable and 1 means disable. On the desktop, the same switch is in Preferences, Control Centre, Interfaces. On Bookworm and older releases the tool is called Raspberry Pi Configuration.

Card already written, no screen: the ssh file

Put the card in another computer, or use a shell on the Pi, and create an empty file named ssh on the boot partition. On the Pi itself that partition is mounted at /boot/firmware:

sudo touch /boot/firmware/ssh

On another computer it shows up as a small drive: put the file at its top level, with no extension. Then restart the Pi.

This only turns the server on. It does not create a user. Images have had no default pi user since April 2022, so a card written without Imager settings still needs an account before you can log in. The simplest fix is to write the card again with Imager and set the user there.

Find the Pi and connect

Give it a minute or two on first boot. Then try the name:

ping raspberrypi.local
ssh user@raspberrypi.local

Use your own hostname and username if you set them. The .local name needs mDNS on the computer you connect from. If it does not resolve, use the IP address instead. To find it:

  • On the Pi, if you have a screen, run hostname -I.
  • Look in your router's list of connected devices.
  • Scan your own network, adjusting the range to match it:
sudo nmap -sn 192.168.1.0/24

If the login stops at Connection refused, the server is not on yet: the first boot may still be generating host keys, or the setting did not take. If the name does not resolve, see Could not resolve hostname.

After the first login

Install your key if you started with a password, then turn password login off, especially if the Pi will be reachable from outside your home network.

Once you have several boards, see how to manage many SSH servers with groups and tags.

Questions

What is the default username and password on a Raspberry Pi?

There is no default password to rely on. Since April 2022 Raspberry Pi OS images have no default pi user: you create the user in Imager or at first boot.

Sources

More in SSH on each system

All guides