Turning on SSH on Ubuntu is sudo apt install openssh-server followed by sudo systemctl enable --now ssh. The daemon listens on port 22, accepts public-key auth by default, and is ready to receive connections as soon as the install completes. The team that runs the install on a fresh cloud VM has SSH working in under a minute.
Table of contents
- Install openssh-server
- Enable and start the daemon
- Open the firewall
- Test the connection
- Set up public-key auth
- FAQ
Install openssh-server
On Ubuntu 22.04+ (and 20.04, 18.04):
sudo apt update
sudo apt install -y openssh-serverThe package pulls in the server binary, the systemd unit, and the default /etc/ssh/sshd_config. The team that runs this on a fresh server has SSH daemon installed but not yet started.
Enable and start the daemon
sudo systemctl enable --now ssh does two things: enable makes the service start at boot, --now starts it immediately. The ssh (or sshd - both work) unit is the right target.
Check the status:
sudo systemctl status sshThe team that sees active (running) has the daemon up. The team that sees inactive or failed needs to check journalctl -u ssh -e for the error.
Open the firewall
On Ubuntu with ufw enabled:
sudo ufw allow OpenSSH
# or explicitly:
sudo ufw allow 22/tcp
sudo ufw reloadThe team that runs the server in a cloud provider also needs to open port 22 in the cloud security group (AWS, GCP, Azure, DigitalOcean). The team that opens the OS firewall but forgets the cloud security group is debugging in the wrong place.
Test the connection
From another machine:
ssh user@server-ipThe first connection prompts Are you sure you want to continue connecting (yes/no/[fingerprint])? - this is the host key verification. Type yes to add the server’s host key to ~/.ssh/known_hosts.
The team that has password auth disabled (the modern default) gets Permission denied (publickey) after this step. The fix is to set up public-key auth - see the next section.
Set up public-key auth
Generate a key on the client (if not already done):
ssh-keygen -t ed25519 -C "[email protected]"Copy the public key to the server:
ssh-copy-id user@server-ipssh-copy-id prompts for the user’s password (one last time) and appends the public key to ~/.ssh/authorized_keys with the right permissions. From the next login onward, public-key auth handles the connection.
FAQ
Do I need to install SSH on Ubuntu Desktop?
The desktop edition does not include the SSH server by default. sudo apt install openssh-server adds it. The server edition has it preinstalled.
Why does sudo systemctl status ssh show ‘failed’?
The daemon failed to start. sudo journalctl -u ssh -e shows the error. Common causes: bad config in /etc/ssh/sshd_config, missing host keys (run sudo ssh-keygen -A to regenerate them), or port already in use.
Can I change the port to something other than 22?
Yes. Edit /etc/ssh/sshd_config, change Port 22 to Port 2222, then sudo systemctl reload ssh. Update the firewall and client config accordingly.
How do I disable password authentication?
Edit /etc/ssh/sshd_config, set PasswordAuthentication no, then sudo systemctl reload ssh. Public-key auth is the only way in. The team that does this needs to make sure their public key is in ~/.ssh/authorized_keys first or they will lock themselves out.
Where are the SSH logs?
/var/log/auth.log on Ubuntu. sudo tail -f /var/log/auth.log watches it live. The team that monitors SSH access uses this for failed attempts, successful logins, and config changes.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: