How to Install OpenSSH Server on Ubuntu 24.04

How to Install OpenSSH Server on Ubuntu 24.04

by

Managing a Linux server remotely is something you’ll eventually need to do, whether you’re running a VPS, hosting a website, deploying applications, or maintaining production infrastructure.

One of the first things I set up on a fresh Ubuntu server is SSH access. It gives me a secure way to manage the machine without having to access its physical console every time I need to run a command or troubleshoot something.

Ubuntu 24.04 LTS includes support for OpenSSH, making it straightforward to enable remote access. In this guide, I’ll walk you through installing OpenSSH Server, configuring the service, allowing SSH connections through the firewall, and connecting to your server from another machine.

I’ll also cover a few common issues you might encounter along the way.

What you’ll need:

  • A server running Ubuntu 24.04 LTS.
  • A user account with sudo privileges.
  • An active internet connection.
  • The server’s public or private IP address.
  • An SSH client on the computer you’ll use to connect.

Let’s get started.

1. Update Your Ubuntu 24.04 System

Before installing OpenSSH, it’s a good idea to update your package information and install any available system updates.

Connect to your Ubuntu server through its terminal or hosting provider’s console and run:

sudo apt update
sudo apt upgrade -y

The first command refreshes the package index, while the second installs available package updates.

Keeping your system updated is particularly important for internet-facing servers. Security patches and package updates help reduce the risk of running outdated software.

Once the update process finishes, you’re ready to install OpenSSH.

2. Install OpenSSH Server on Ubuntu 24.04

Ubuntu provides OpenSSH through its official package repositories. The server component is distributed as openssh-server.

To install it, execute:

sudo apt install openssh-server -y

APT will download and install the OpenSSH server package along with its required dependencies.

After installation, you can check the installed version using:

ssh -V

This command displays the SSH client version, which is useful for checking the installed OpenSSH software. It does not independently verify that the server daemon is running.

You can also check the server package installation with:

dpkg -l openssh-server

If the package is installed successfully, you should see its status listed as ii.

At this point, OpenSSH Server is installed. The next step is checking how its service is managed on Ubuntu 24.04.

3. Check the OpenSSH Service Status

On Ubuntu, the OpenSSH server uses the ssh systemd service.

However, there’s something worth knowing about Ubuntu 24.04.

Ubuntu uses systemd socket activation for OpenSSH by default. This means the SSH listening socket can be active even when the SSH service itself isn’t continuously running.

Start by checking the socket:

sudo systemctl status ssh.socket

You should see an active status if the SSH socket is listening.

Next, check the SSH service:

sudo systemctl status ssh.service

Depending on the socket activation state, the service might show as inactive even though the SSH socket is working normally.

You can also check the listening port:

sudo ss -tlnp | grep ':22'

By default, OpenSSH listens on TCP port 22.

If you want to inspect the socket configuration, run:

sudo systemctl list-units --type=socket | grep ssh

This is a useful distinction when troubleshooting Ubuntu 24.04 servers. An inactive ssh.service does not automatically mean that SSH is unavailable.

4. Configure the Firewall to Allow SSH Connections

Installing OpenSSH doesn’t automatically guarantee that remote connections will reach your server.

If you’re using UFW (Uncomplicated Firewall), you need to allow incoming SSH connections.

First, check the firewall status:

sudo ufw status

If UFW is inactive, you can configure it before enabling it.

Allow the default SSH profile:

sudo ufw allow OpenSSH

Alternatively, you can explicitly allow TCP port 22:

sudo ufw allow 22/tcp

Now enable UFW:

sudo ufw enable

Check the rules:

sudo ufw status verbose

You should see a rule allowing SSH traffic on port 22.

Important: If you’re managing a remote server, make sure the SSH rule is in place before enabling the firewall. Otherwise, you could accidentally lock yourself out.

Also remember that cloud providers often have their own network firewalls or security groups. If your VPS provider blocks port 22, changing UFW rules alone won’t solve the problem.

5. Connect to Your Ubuntu Server Using SSH

Now comes the interesting part: connecting to your server remotely.

You need three things:

  • Your Ubuntu server’s IP address.
  • A valid Linux username.
  • An available SSH client.

From another Linux or macOS machine, open a terminal and run:

ssh username@server_ip

Replace username with your actual Ubuntu account and server_ip with your server’s IP address.

For example:

ssh [email protected]

On your first connection, SSH may display a message asking you to verify the server’s host fingerprint.

If the fingerprint matches the server you’re expecting, type:

yes

You’ll then be prompted for the account password if password authentication is enabled.

Once authentication succeeds, you’ll have a remote terminal session on your Ubuntu server.

Connecting from Windows

Windows 10 and Windows 11 include an OpenSSH client in supported installations.

Open PowerShell or Windows Terminal and execute:

ssh username@server_ip

The connection process is essentially the same as on Linux.

If you’re using PuTTY instead, enter the server IP address, select SSH as the connection type, and use port 22 unless you’ve configured a different port.

6. Configure SSH Key Authentication (Recommended)

Password authentication is convenient, especially when you’re getting started. However, for servers exposed to the public internet, SSH key authentication is generally a better choice.

SSH keys use a cryptographic key pair consisting of:

  • Private key: Stays on your local computer and should never be shared.
  • Public key: Can be copied to your Ubuntu server.

On your local computer, generate an Ed25519 key pair:

ssh-keygen -t ed25519

Follow the prompts to choose where to save the key and whether to protect it with a passphrase.

Next, copy the public key to your Ubuntu server:

ssh-copy-id username@server_ip

This command adds your public key to the remote user’s ~/.ssh/authorized_keys file.

If you’re using Windows and don’t have ssh-copy-id, you can copy the public key manually.

First, display your public key:

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

Copy its contents and add it to the ~/.ssh/authorized_keys file for your Ubuntu user.

Make sure the SSH directory and authorized keys file have appropriate permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Now test the connection again:

ssh username@server_ip

If everything is configured correctly, you should be able to authenticate using your SSH key.

7. Basic OpenSSH Server Configuration

Once remote access is working, you may want to adjust a few SSH settings.

The main OpenSSH server configuration file is:

/etc/ssh/sshd_config

Ubuntu also supports configuration snippets inside:

/etc/ssh/sshd_config.d/

I generally prefer using a separate configuration snippet for custom settings because it keeps configuration changes organized and easier to maintain.

Before making changes, create a backup:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

You can create a custom configuration file:

sudo nano /etc/ssh/sshd_config.d/99-custom.conf

For example, you might want to configure the following options:

PermitRootLogin no
PubkeyAuthentication yes

The first setting prevents direct root login, while the second explicitly enables public key authentication.

A word of caution: Don’t disable password authentication until you’ve successfully tested SSH key authentication in a separate session. Keep your existing SSH session open while making changes.

After editing the configuration, validate it:

sudo sshd -t

If the command returns no output, the configuration has passed the syntax check.

You can then apply the changes:

sudo systemctl restart ssh.service

On Ubuntu 24.04, changes to SSH listening settings can also affect the systemd socket configuration. If you change the listening port or address, check the socket activation configuration and ensure the new port is allowed through both UFW and your cloud firewall.

Never close your existing working session until you’ve confirmed that a new connection works.

8. Troubleshooting Common OpenSSH Issues

Even though OpenSSH is relatively straightforward to install, a few problems can prevent remote connections.

Here are some common situations and how I would approach them.

Connection refused

If your SSH client returns:

ssh: connect to host server_ip port 22: Connection refused

The server is reachable, but nothing is accepting connections on the requested port.

Start by checking the SSH socket:

sudo systemctl status ssh.socket

Then check whether anything is listening on port 22:

sudo ss -tlnp | grep ':22'

Also verify that OpenSSH Server is installed correctly.

Connection timed out

A timeout usually means your client cannot establish a connection to the server within the expected time.

Check the following:

  • Whether the server is online.
  • Whether port 22 is allowed through UFW.
  • Whether your VPS provider’s firewall allows incoming SSH traffic.
  • Whether you’re connecting to the correct IP address.
  • Whether your network is blocking outbound SSH traffic.

For cloud servers, checking the provider’s security group or network firewall is especially important.

Permission denied (publickey)

This error usually indicates that SSH key authentication failed.

Check that:

  • You’re connecting with the correct Linux username.
  • Your public key exists in ~/.ssh/authorized_keys.
  • The private key on your local computer matches the public key installed on the server.
  • File permissions are correct.

You can also enable verbose output on the client:

ssh -v username@server_ip

For more detailed troubleshooting, use:

ssh -vvv username@server_ip

These options provide additional information about the authentication process and can help identify where the connection fails.

Check SSH logs

When troubleshooting on the server, system logs are often the most useful source of information.

Run:

sudo journalctl -u ssh.service -n 50 --no-pager

To follow new log entries in real time:

sudo journalctl -fu ssh.service

These commands help you identify authentication failures, service errors, and other SSH-related problems.

9. A Practical Note From Managing Linux Servers

One thing I’ve learned from working with Linux infrastructure is that getting SSH access working is usually the easy part. Keeping that access reliable and secure is what really matters.

I’ve worked with different Linux environments, including cloud-based Kubernetes infrastructure and production servers, where remote access is essential for daily operations.

One situation that stands out is troubleshooting infrastructure problems where a service appears to be unavailable even though the underlying server is still running.

It’s tempting to immediately restart services or change configuration files. But that isn’t always the best first step.

For SSH-related issues, I prefer checking things in a specific order:

  1. Verify whether the SSH socket is listening.
  2. Check the service status and system logs.
  3. Confirm the firewall rules.
  4. Check the network path between the client and server.
  5. Only then consider changing the SSH configuration.

This approach helps avoid unnecessary changes, especially when you’re working on a remote production server.

A small configuration mistake can turn a manageable troubleshooting session into an emergency if SSH is your only way to access the machine.

That’s why I always recommend testing a second SSH connection before closing the first one.

It’s a simple habit, but it can save a lot of time.

10. Final Verification

Before considering the installation complete, run through this quick checklist.

  • OpenSSH Server package is installed.
  • SSH socket is active.
  • TCP port 22 is listening.
  • UFW allows incoming SSH connections, if enabled.
  • Cloud firewall or security group allows SSH traffic.
  • Remote SSH login works.
  • SSH key authentication has been tested, if configured.

You can also verify the installed package:

dpkg -l openssh-server

And check the listening port:

sudo ss -tlnp | grep ':22'

If these checks look good and you can connect remotely, your OpenSSH Server installation is ready.

Frequently Asked Questions (FAQs)

1. Is OpenSSH installed by default on Ubuntu 24.04?

Ubuntu typically includes the OpenSSH client, but the server component may not be installed. To enable incoming SSH connections, install the server package using sudo apt install openssh-server.

2. What is the default SSH port on Ubuntu 24.04?

The default SSH port is TCP 22. You can verify the listening port using sudo ss -tlnp | grep ':22'.

3. How do I start the SSH service on Ubuntu 24.04?

You can start the SSH service with:

sudo systemctl start ssh.service

Ubuntu 24.04 also uses systemd socket activation by default, so you should check ssh.socket when verifying whether SSH is accepting connections.

4. How do I restart OpenSSH Server?

Run:

sudo systemctl restart ssh.service

If you’ve changed SSH configuration, validate it first with sudo sshd -t.

5. How do I check whether OpenSSH is installed?

Use:

dpkg -l openssh-server

If the package is installed, its status should show ii.

6. Can I connect to Ubuntu 24.04 from Windows?

Yes. Windows 10 and Windows 11 support OpenSSH Client in supported installations. Open PowerShell or Windows Terminal and execute ssh username@server_ip.

7. Is SSH key authentication safer than password authentication?

SSH key authentication is generally preferable for internet-facing servers when configured properly. It avoids relying on reusable account passwords for remote SSH authentication. Protect your private key with a strong passphrase and keep your server software updated.

8. Can I change the default SSH port from 22?

Yes. OpenSSH supports custom listening ports through its server configuration. However, Ubuntu 24.04 uses systemd socket activation, so changing the port may also require updating the socket configuration. Remember to update your firewall rules before switching ports.

Conclusion

Installing OpenSSH Server on Ubuntu 24.04 is a straightforward process, but there are a few details worth understanding beyond the initial installation.

By installing the openssh-server package, checking systemd socket activation, configuring firewall access, and testing remote authentication, you can establish reliable SSH access to your Ubuntu machine.

If you’re setting up a new VPS or preparing a Linux server for application deployment, SSH is one of the first services I’d recommend configuring properly.

Once everything is working, consider moving toward SSH key authentication and reviewing your server’s security settings before exposing it to the public internet.

A properly configured SSH server gives you a solid foundation for managing your Linux infrastructure remotely.

References

Ubuntu Server Documentation – OpenSSH Server — Official installation and configuration guide.

Ubuntu 24.04 OpenSSH Configuration Manual — sshd_config manual