How to Enable and Secure SSH on Ubuntu

Use sudo apt install openssh-server to activate SSH on Ubuntu. Ubuntu doesn't provide SSH by default, so that's literally it for you to turn on the SSH service. This article will explain how to do that, open the ports for SSH via firewall, ensure it's running, and make it secure afterwards.

How do I allow SSH on Ubuntu?

Use sudo apt install openssh-server. Ubuntu doesn't provide it by default, so that's literally it for you to turn on the SSH service.

$ sudo apt update
$ sudo apt install openssh-server

As it is stated in Ubuntu official server documentation, it will install "the OpenSSH server application, and related support files". After any modifications to its configuration file, sudo sshd -t checks its syntax prior to service restart. That's worth to do first because a wrong configuration may simply fail to apply at next restart without raising any error.

How do I open SSH through the firewall?

Use sudo ufw allow OpenSSH (or sudo ufw allow 22/tcp if you have changed port number). Installation of the SSH server will not open the hole in the firewall if ufw is enabled.

$ sudo ufw allow OpenSSH
$ sudo ufw status

sudo ufw allow OpenSSH uses application profile which comes with openssh-server package. It is more memorable than the port number and updated automatically when you change it in sshd_config. Skip this step and ufw will silently drop SSH requests despite the service itself is running properly.

How do I check that SSH is actually running?

Use sudo systemctl status ssh. In case of inactive service, sudo systemctl enable --now ssh starts it and ensures that it will start on boot.

$ sudo systemctl status ssh
$ sudo systemctl enable --now ssh

In case of any modification in sshd_config, use sudo systemctl restart ssh.service to restart the service, rather than just enable – enable only affects on whether the service will start at boot, not whether the current running process will apply its new settings.

How do I secure SSH once it's working?

Set up key-based authentication and then disable password authentication and root login in /etc/ssh/sshd_config. Perform these steps in the order specified above – disable passwords before you've made sure that the key authentication works, otherwise, you can lock yourself out.

PasswordAuthentication no
PermitRootLogin no

Test the key authentication from another terminal window before closing the current one – in case of some mistakes in configuration, you will need an available session to fix it, not to discover only after you've logged out.

Where does SSH access matter most on a server?

Everywhere – it's often the only access method on a machine which is not connected to a screen, which is the majority of servers.

Our VPS plans and Bare Metal servers give you SSH access since you provisioned it and full root permissions for sshd_config and ufw to secure it as it is explained above.