WardtermSSH client
EN
Download

How to enable SSH on Ubuntu

Run sudo apt update, then sudo apt install openssh-server, then sudo systemctl enable --now ssh. If ufw is active, also run sudo ufw allow OpenSSH. Check with ss -tln | grep ':22', then connect from another machine with ssh user@server.

Updated . Commands run in throwaway containers with systemd: Ubuntu 24.04 (OpenSSH 9.6) and Ubuntu 26.04 (OpenSSH 10.2).

Install and start the server

sudo apt update
sudo apt install openssh-server
sudo systemctl enable --now ssh

On a normal Ubuntu system the package starts listening as soon as it is installed. The last command does no harm if it already does, and it makes the setup explicit.

Check that it is listening

ss -tln | grep ':22'

You should see one line for 0.0.0.0:22 and one for [::]:22. To find the address to connect to, run:

hostname -I

Why ssh.service can say inactive while SSH works

Since Ubuntu 22.10, including 24.04 and 26.04, a unit called ssh.socket holds port 22 by default, and it starts ssh.service at the first connection. So right after installing, or after sudo systemctl stop ssh, you can see this and still be able to connect:

systemctl is-active ssh.socket    # active
systemctl is-active ssh           # inactive until the first connection

This is normal. If you stop the service while the socket is active, systemd warns you that its triggering unit is still active, and the next connection starts it again. To really stop SSH, stop both:

sudo systemctl disable --now ssh ssh.socket

If you prefer the older behavior, where sshd runs all the time and reads its port at each restart, turn the socket off:

sudo systemctl disable --now ssh.socket
sudo systemctl enable --now ssh

Debian does the opposite by default: on Debian 13, ssh.service is enabled and ssh.socket is disabled. Ubuntu 22.04 also uses the plain service.

Open the firewall

ufw is off by default on most installs. Check it first:

sudo ufw status

If it says Status: active, allow SSH:

sudo ufw allow OpenSSH

If it says inactive and you want it on, add the rule first and enable it after. The order matters, see how to allow SSH in ufw. A cloud server usually has a second firewall in the provider's panel, which you open there.

Test the login

From another machine:

ssh user@server

The first connection shows the server's fingerprint and asks you to confirm. If the connection fails, these guides cover the common messages: Connection refused and Connection timed out.

What that fingerprint is, and where it is kept, is covered in known_hosts and host fingerprints explained.

Changing the configuration

The settings are in /etc/ssh/sshd_config and in the files under /etc/ssh/sshd_config.d/. A file in that folder takes precedence over the main file, and some images ship one that sets password login, so check what is really in force:

sudo sshd -T | grep -i -E '^(port|passwordauthentication) '

After an edit, check the syntax, then restart:

sudo sshd -t
sudo systemctl restart ssh

A new port or listen address is different, because the socket has to be rebuilt as well. See how to change the SSH port.

Next, give yourself a key instead of a password: generate a key, then turn password login off.

Questions

Is SSH installed on Ubuntu by default?

The client usually is. The server depends on how the system was installed: Ubuntu Desktop does not include it, and the Server installer asks. Run dpkg -l openssh-server to check.

What is the difference between ssh and sshd on Ubuntu?

sshd is the server program. On Ubuntu its systemd unit is called ssh, and sshd is an alias created when you enable the unit, so use ssh in commands.

Sources

More in SSH on each system

All guides