Secure Shell (SSH) is the absolute cornerstone of Linux server administration. It allows administrators to securely log in, execute commands, and transfer files over an encrypted network connection. Because of its critical role, the OpenSSH server daemon (sshd) is almost always installed and enabled by default on Ubuntu Server installations. However, if you are configuring a specialised machine—such as a strictly isolated database node, a physical kiosk, or a server managed entirely through a hypervisor console or serial port—leaving an active SSH daemon running is an unnecessary expansion of your attack surface. If a port is not needed, it should be closed.
This guide explains how to completely disable the SSH daemon on Ubuntu Server, preventing any remote network logins via port 22.
Stop and Mask the SSH Daemon via Systemctl
To ensure that the SSH daemon cannot accept connections, you must stop the currently running process and disable it from starting upon the next reboot. For maximum security, we will also “mask” the service, which prevents other services or accidental administrator commands from starting it back up.
- Log into your Ubuntu Server. (Note: Ensure you have physical, out-of-band, or hypervisor console access before proceeding. Running these commands over an active SSH session will sever your connection and lock you out if you have no other way in!).
- Stop the active SSH service immediately:
sudo systemctl stop ssh.service - Disable the service so it does not load during the boot sequence:
sudo systemctl disable ssh.service - Mask the service to link its configuration to
/dev/null, making it completely unstartable:sudo systemctl mask ssh.service
Note: Depending on your exact Ubuntu version, the service might be named sshd.service instead of ssh.service. If the commands above fail, simply replace ssh with sshd.
Verify Port 22 is Closed
Once the daemon is masked, it will immediately stop listening for incoming connections.
To mathematically verify that your server is no longer exposing port 22 to the network, use the ss (socket statistics) command to list all active listening TCP ports:
sudo ss -tulpn | grep :22If the daemon has been successfully disabled, this command will return completely blank output. Your Ubuntu Server will now reject all remote SSH connection attempts, and all future administration must be performed via a local console or a separate management agent.