How to Enable and Secure an SSH Server in Ubuntu Linux

If you have recently installed a headless Ubuntu server, set up a Raspberry Pi, or spun up a cloud instance on AWS or DigitalOcean, your first administrative task is almost always establishing remote access. Managing a server by physically connecting a monitor and keyboard is highly inefficient. Instead, you need to use Secure Shell (SSH), a cryptographic network protocol that allows you to operate your Linux machine securely over an unsecured network.

Ubuntu does not always have the SSH server enabled by default, especially on desktop editions. This guide will walk you through the process of installing the OpenSSH server, verifying that it is running, and applying fundamental security practices to protect your machine from automated internet attacks.

Step 1: Install the OpenSSH Server

The standard software used to run an SSH server on Ubuntu is OpenSSH. It is available directly from the official Ubuntu software repositories.

1. Open your terminal application (if you are on Ubuntu Desktop, press Ctrl + Alt + T).
2. First, update your package index to ensure you are downloading the latest version of the software. Type the following command and press Enter: sudo apt update
3. You will be prompted for your administrator (sudo) password. Type it in and press Enter.
4. Once the update is complete, install the OpenSSH server package by typing: sudo apt install openssh-server
5. Press Y and then Enter if prompted to confirm the installation.

Step 2: Verify the SSH Service is Running

After the installation completes, the SSH service should start automatically. However, it is always best practice to verify its status.

1. Type the following command into your terminal: sudo systemctl status ssh
2. Look for the line that says Active: active (running). It will usually be highlighted in green.
3. If the service is not running for some reason, you can start it manually with: sudo systemctl start ssh
4. To ensure the SSH server automatically starts every time you reboot your computer, type: sudo systemctl enable ssh

Step 3: Allow SSH Through the Firewall

If you have the Uncomplicated Firewall (UFW) enabled on your Ubuntu machine (which is highly recommended), it will block incoming SSH connections by default. You must configure the firewall to allow traffic through port 22, which is the default port for SSH.

1. To add an exception for SSH, type: sudo ufw allow ssh
2. You should see a message stating “Rule added”.
3. You can verify that the firewall is active and allowing SSH by typing: sudo ufw status

Step 4: Connect to Your Server

Your Ubuntu machine is now ready to accept incoming remote connections. To connect, you will need to know the IP address of the server.

1. On your Ubuntu server, type: ip a to find your local IP address (look for the number next to inet, usually starting with 192.168).
2. Move to a different computer on the same network. Open a terminal (on Mac or Linux) or Command Prompt (on Windows).
3. Type the SSH command in the following format: ssh username@ip_address (For example: ssh [email protected]).
4. The first time you connect, you will be asked to verify the ECDSA key fingerprint. Type yes and press Enter.
5. Enter your password. You now have full remote control of your Ubuntu server.

Fundamental Security Recommendations

Opening port 22 to the internet makes your server an immediate target for automated bots running brute-force password guessing attacks. To secure your setup, consider implementing these basic hardening steps:

• Use SSH Keys: Instead of relying on a typed password, configure public-key cryptography. It is significantly more secure and immune to basic brute-force attacks.
• Disable Root Login: Edit the /etc/ssh/sshd_config file and set PermitRootLogin no. This forces attackers to guess both your username and your password, rather than just brute-forcing the default “root” account.
• Install Fail2Ban: This lightweight security tool automatically bans IP addresses that repeatedly fail to log in, drastically reducing the effectiveness of automated attacks.

Establishing an SSH connection is the gateway to mastering Linux administration, but it must be done with security in mind from day one.