The Remote Access Risk
On almost all Ubuntu Server installations (and many developer desktop setups), the sshd (Secure Shell Daemon) service is installed and enabled by default. This service listens on network port 22 and allows users to log into the machine remotely using an SSH client. It is the absolute backbone of remote Linux administration.
However, if you are building an offline kiosk, a strictly local media server, or a desktop PC that should never be accessed over the network, leaving the SSH daemon running is a massive and unnecessary security risk. It leaves a port open to potential brute-force password attacks from anyone on your local network (or the internet, if your router is misconfigured). If you only ever intend to interact with the machine using a physically connected keyboard and monitor, you must disable the SSH service.
How to Disable the SSH Service
You can completely shut down remote access capabilities using systemctl.
Warning: Do not do this if you are currently logged into the server via SSH (e.g., a cloud VPS). You will immediately lose your connection and lock yourself out of the server permanently.
- Open your Ubuntu Terminal using the physically connected keyboard and monitor.
- Stop the currently active SSH daemon to immediately terminate any existing remote connections and close the port:
sudo systemctl stop ssh.service- Disable the service so it never starts up again when the machine reboots:
sudo systemctl disable ssh.serviceThe SSH daemon is now dead. The machine will refuse all incoming SSH connection attempts, ensuring it can only be managed by someone physically standing in front of it.