SSH is the backbone of remote access on Linux systems—and if you're running Ubuntu, enabling SSH is often one of the first things you'll do. But enabling it securely is what really matters.
From installing OpenSSH and adjusting firewalls to enforcing key-based authentication and disabling root login, a secure setup takes more than just flipping a switch.
This guide walks you through every step, plus how to make SSH access safer and simpler with centralized control, just-in-time access, and full audit trails that eliminate static keys and manual headaches.
Before you enable SSH on Ubuntu, there are several requirements you must meet, including:
Once you have everything in order, you can start the process of installing SSH. Here’s how:
Keep your system packages current to ensure they have the necessary software dependencies for SSH to operate efficiently. To do this:
At the terminal prompt, use the command below to install the OpenSSH server:
sudo apt install openssh-server
Activate the SSH service and start immediately by typing the command below:
sudo systemctl enable --now ssh
Next, confirm the status of the server you just installed with this command:
sudo systemctl status ssh
If successful, you’ll receive this confirmation message:
Active: active (running)
By default, the uncomplicated firewall (UFW) is usually configured to deny all incoming traffic. If it's not adjusted, you can’t connect to your server remotely via SSH.
Here’s how to adjust it:
After you successfully enable SSH on Ubuntu, you must configure it because its default settings can make it vulnerable to malicious actors. To customize it, you should edit the SSH configuration file: /etc/ssh/sshd_config. This file contains many directives that control features like authentication modes and communication settings.
Here are some steps we recommend to enhance security:
Since it’s common knowledge that the default port number is 22, it’s best to change it as a security best practice. While this reduces the number of automated scanning attacks in a technique known as security through obscurity, it shouldn’t be the only line of defense.
Here’s how to do this:
Back up the config file first.
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
Launch the SSH configuration file and use a text editor to run the following command:
sudo nano /etc/ssh/sshd_config
Then, find the line that specifies Port 22 in the file, and change it to the port you want, such as Port 2111.
If you can log in remotely using root, this can be a gateway for hackers who want to take over your system. Therefore, it’s best to disable it.
From the configuration file, find the line that enables root login. It should look like this: PermitRootLogin yes. Change it to PermitRootLogin no.
Restart the SSH services for the changes to take effect using this command: sudo systemctl restart ssh.
You can prevent attackers from using brute force attacks by limiting how many times a user can try logging in. For instance, if you want to limit the number of tries to only two, you can set this in the configuration file as shown below:
MaxAuthTries 2
Passwords are susceptible to theft by hackers using techniques like brute force attacks, keylogging, and man-in-the-middle attacks. SSH keys offer more security because they eliminate the need to type passwords to log in.
To enforce SSH keys, set PubkeyAuthentication yes in the sshd_config file. Also, disable password authentication by setting PasswordAuthentication no.
NOTE: Confirm that key-based auth works before disabling passwords to avoid lockout by opening a second terminal session and connecting to your server using your SSH key.
Lastly, don’t forget to restart the service to save the changes:
sudo systemctl restart ssh
SSH keys come in pairs: the public key and the private key. The private key gets stored by the client and should remain secret, while its associated public key lives on the remote server you need to access. The public key can be distributed freely without any problems. When a client tries to log in to the server, it must prove that it possesses the private key. If the client does, the server authenticates it.
From your local computer, you can generate an SSH key pair by using the ssh-keygen command. To do this:
ssh-keygenThe output will look like this:
Generating public/private rsa key pair.
Enter the file in which to save the key (/home/username/.ssh/id_rsa):
ssh-keygen -t rsa -b 4096
There are several methods to copy and send the public key you created to the server. For this illustration, we’ll use the ssh-copy-id utility. Worth noting is that you must be able to access your server via password for this method to work.
Here’s the command to use:
ssh-copy-id username@your_server_ip
NOTE: This command requires openssh-client to be installed locally, which is usually present but worth confirming
With the SSH keys now in place, you can disable password authentication in the /etc/ssh/sshd_config file.
Example SSH hardening settings:
Port 2111
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
PubkeyAuthentication yes MaxAuthTries 2
Restart the SSH service using sudo systemctl restart ssh to save the changes.
After configuring SSH and setting up authentication, you can test whether access is possible. From the machine’s terminal, use the ssh command as shown below:
ssh -p your_port_number your_username@your_server_ip
The -p flag is only necessary if the default port was changed.
Enabling SSH on Ubuntu can be quite the task, especially if you have a lot of configurations to do. That’s why you have the option of automating the installation and configuration processes with scripts. Here’s a sample script you can use to do this:
#!/bin/bash set -e
sudo apt update
sudo apt install -y openssh-server
sudo systemctl enable --now ssh
sudo ufw allow ssh
sudo ufw enable
To disable root login and change port, use:
sudo sed -i "s/^#\?Port .*/Port ${SSH_PORT}/" $SSH_CONFIG
sudo sed -i "s/^#\?PermitRootLogin .*/PermitRootLogin no/" $SSH_CONFIG
As is usually the case with many processes, you should be prepared to encounter a few issues when attempting to install and configure SSH on Ubuntu. Two of the most common errors include:
You’ll typically see this error if the SSH service isn’t running on the server or if a firewall is blocking the connection.
sudo systemctl status ssh sudo ufw allow ssh This error usually indicates a problem with your SSH key authentication. You might be using the wrong key or attempting to log in with password authentication when the server is configured to accept only keys.
~/.ssh/authorized_keys chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys .ssh directory and its contents: chown -R $USER:$USER ~/.sshEnabling SSH on Ubuntu is a critical first step for remote access—but doing it securely is what protects your infrastructure from unauthorized access and misconfigurations. From port changes to key-based authentication, strong defaults are essential—but so is visibility and control.
That’s where Delinea comes in. While SSH configuration starts with OpenSSH and UFW, it should end with centralized, audited, and identity-based access. Here's how Delinea simplifies and strengthens SSH security:
Manually managing SSH keys is error-prone and risky. Delinea replaces long-lived keys with ephemeral, identity-based credentials:
.pem filesResult: no lingering keys, no forgotten access, and no risk of leaked credentials.
Managing multiple SSH configurations across machines is a mess. Delinea gives you:
Even if you use multiple ports, proxies, or hostnames—Delinea abstracts it all.
SSH access to the root user is a security hole. Delinea enforces:
You don’t need to edit sshd_config manually or hope your team follows protocol — Delinea enforces it.
No more grepping log files or chasing down missing sessions. Delinea automatically logs:
You can export logs to SIEM tools (Splunk, Datadog, Elastic) and replay sessions for compliance or investigation.
Whether you’re managing one server or a thousand, Delinea:
No more patching shell scripts to harden SSH across environments—Delineahandles it from a central dashboard.
Manual SSH setup is a start. Delinea is how you secure it—at scale, in real time, and without the operational overhead.
Book a demo to see how we make SSH access secure by default.