VMware ESXi and vSphere Cluster Management

Enable SSH on Raspberry Pi OS (Raspbian) for Remote Terminal Access

Learn how to enable SSH on Raspberry Pi OS, find the Pi's network address, connect from Windows, macOS, or Linux, and secure remote access.

SSH (Secure Shell) is an encrypted client-server protocol for logging in to another computer and running commands remotely. By enabling SSH on a Raspberry Pi, you can administer it, install software, inspect services, and develop projects without connecting a monitor and keyboard.

The computer you connect from runs an SSH client, such as PuTTY or OpenSSH. The Raspberry Pi runs the SSH server, usually provided by the OpenSSH sshd service. Credentials and terminal traffic are encrypted while traveling across the network.

Requirements before connecting

• The Raspberry Pi must be powered on and connected to the same local network as the client computer, unless you have deliberately configured routing between networks.
• You need the Pi's hostname or local IP address.
• The SSH server must be enabled and running.
• You need the username and password created during Raspberry Pi OS installation or imaging, or a configured SSH key.

Modern Raspberry Pi OS installations commonly leave SSH disabled until you explicitly enable it. This reduces the number of network services exposed by a new installation.

Enable SSH with raspi-config

If you have local access to the Pi, open a terminal and launch the Raspberry Pi configuration utility:

sudo raspi-config

1. Open the SSH interface setting. On older releases it may be under Advanced Options; on newer releases it is commonly under Interface Options.
2. Select the SSH option and choose to enable the SSH server.
3. Confirm the prompt.
4. Exit the utility.

Menu names and locations differ between Raspbian releases and current Raspberry Pi OS versions. The important setting is the one that enables the SSH server, not the exact menu label.

Check that the service is running:

sudo systemctl status ssh

Look for an active (running) state. Press q to leave the status display.

Other ways to enable SSH

Noninteractive raspi-config

The same configuration can be performed from a script or terminal without opening the menu:

sudo raspi-config nonint do_ssh 0

The 0 argument enables SSH in the common noninteractive raspi-config interface. You can then check the service with systemctl.

Enable the service with systemctl

On Raspberry Pi OS systems using systemd, enable SSH at boot and start it immediately:

sudo systemctl enable --now ssh

Service naming can vary on some systems. Raspberry Pi OS normally uses ssh. If this command fails, inspect available service names with:

systemctl list-unit-files | grep -E 'ssh|sshd'

Configure SSH before first boot with Raspberry Pi Imager

For a headless setup, use Raspberry Pi Imager's advanced or customization settings before writing the operating system image. Configure a username, password, wireless network, locale, and SSH access. After the Pi boots, find its address from the router's client list or by its hostname, then connect without attaching a display or keyboard.

Legacy boot-partition marker file

Some compatible older Raspberry Pi OS or Raspbian images enable SSH on first boot when an empty file named ssh, with no filename extension, is placed in the boot partition of the prepared storage media. This is a first-boot method and its behavior depends on the image version. It is not the preferred method for every current Raspberry Pi OS release; use Raspberry Pi Imager customization or an on-device configuration tool when available.

Find the Raspberry Pi address

Use the Pi's terminal

Display local IP addresses with:

hostname -I

This may show more than one address. Choose the address reachable from the client computer's network. Another useful command provides detailed interface information:

ip address

Use a local hostname

You may be able to connect using a hostname such as raspberrypi.local. The .local form uses mDNS (Multicast DNS), which can resolve local device names without a conventional DNS server. Support depends on the client operating system and network.

Check the router

For a headless Pi, open the router's DHCP or connected-client list. Look for the Raspberry Pi hostname, manufacturer information, or a newly assigned address.

A DHCP-assigned IP address can change after a reboot or lease renewal. Use a DHCP reservation in the router, or another deliberate static-addressing strategy, if you need a stable address.

SSH connection settings

Connect from Windows

Using PuTTY

1. Open PuTTY.
2. Enter the Pi hostname or IP address in the Host Name field.
3. Enter 22 as the port unless SSH was intentionally configured on another port.
4. Select SSH as the connection type.
5. Open the connection.
6. Review the first-connection host-key prompt before accepting it.
7. Enter the username created during Raspberry Pi OS setup, then enter its password.

PuTTY saves connection details and, when accepted, the server's host key. Do not accept a key merely because the dialog appears; first confirm that the destination is your Pi.

Using the built-in OpenSSH client

Modern Windows versions commonly include the OpenSSH client in PowerShell and Command Prompt:

ssh <username>@<pi-hostname-or-ip>

For example:

ssh alex@raspberrypi.local

If the server uses an intentionally changed port, specify it with:

ssh -p <port> <username>@<pi-hostname-or-ip>

Connect from macOS or Linux

Open a terminal and run:

ssh <username>@<pi-hostname-or-ip>

For example:

ssh alex@192.168.1. forty

Use a real numeric address in place of the example placeholder. When prompted, enter the account password. If key authentication is configured, the client may use the key automatically or ask for its passphrase.

Close the remote session safely with:

exit

Understand host-key verification

On the first connection, the SSH client displays the server's host-key fingerprint. A fingerprint is a short representation of the cryptographic host key, which identifies the SSH server. Because the client has not seen this device before, it asks whether to trust the identity.

When possible, verify the fingerprint through a trusted method, such as checking it locally on the Pi or comparing it through a trusted administration channel. Accept it only when you are confident that the address belongs to the intended Pi.

A changed-host-key warning can be legitimate after reinstalling Raspberry Pi OS because the Pi generated new host keys. It can also mean that a DHCP address has been reused by another device, or that someone is intercepting the connection. Do not automatically dismiss the warning. Confirm the device identity first, then remove or replace the saved old key if the change is legitimate.

Authentication and first-login security

Use the username and password created during Raspberry Pi OS installation or imaging. Do not assume that a historical default account or password exists: modern Raspberry Pi OS setup normally requires you to create a user.

Change weak, reused, or easily guessed passwords. A stronger long password is preferable to a short password used across multiple systems.

Use public-key authentication

Public-key authentication uses a key pair. The client keeps the private key secret, while the corresponding public key is installed on the Pi in the account's authorized_keys file. The server then verifies that the client possesses the private key.

Generate an Ed25519 key pair on a Unix-like client, or in a Windows environment that provides OpenSSH:

ssh-keygen -t ed25519

Protect the private key with a passphrase where practical. From a client that provides ssh-copy-id, install the public key with:

ssh-copy-id <username>@<pi-hostname-or-ip>

If ssh-copy-id is unavailable, append the contents of the client's public-key file, commonly ~/.ssh/id_ed25519.pub, to the Pi user's ~/.ssh/authorized_keys file using an authorized local method. Keep the .ssh directory and key file owned by the user and restrict their permissions appropriately.

Test key login in a separate session before considering disabling password authentication. A configuration mistake can otherwise lock you out of remote access.

Verify and use the remote session

After login, run harmless commands to confirm the identity and state of the remote system:

whoami
pwd
hostname
uname -a
systemctl status ssh

The output should identify the Raspberry Pi account, home directory, hostname, operating system kernel, and SSH service. Commands entered after login run on the Raspberry Pi, not on the Windows, macOS, or Linux computer running the client.

SSH is useful for updating packages, changing configuration, checking services, viewing logs, running development tools, and managing headless projects.

Security considerations

• Keep SSH available only on trusted networks whenever possible.
• Avoid forwarding port 22 directly from the public internet unless you understand the risks and have hardened authentication and network access controls.
• Use strong, unique account credentials and preferably SSH keys protected by a passphrase.
• Disable password authentication only after key-based login has been tested in another session.
• Keep Raspberry Pi OS and installed packages updated.
• Disable SSH when remote access is no longer needed:

sudo systemctl disable --now ssh

Use SFTP for encrypted file transfer

SFTP (SSH File Transfer Protocol) transfers files through the SSH service. It is different from interactive SSH terminal access, but both normally use the same server and port 22.

From a terminal, start an SFTP session with:

sftp <username>@<pi-hostname-or-ip>

You can also use a graphical SFTP client such as WinSCP or FileZilla. Connect to the same hostname or IP, select SFTP, use port 22, and authenticate with the same account credentials or SSH key. Transfer files to a directory where that account has permission, such as its home directory.

Troubleshoot SSH connections

SSH worked before but stops after reboot

Make sure the service is enabled at startup:

sudo systemctl enable ssh

Then check its status and logs. Also check whether the Pi received a new DHCP address. A DHCP reservation can prevent this address change from disrupting future connections.

Quick connection checklist

1. Power on the Pi and connect it to Ethernet or Wi-Fi.
2. Enable SSH with raspi-config, systemctl, Raspberry Pi Imager customization, or a compatible first-boot method.
3. Find the Pi's hostname or IP address.
4. Use port 22 and the correct SSH client.
5. Verify the first-connection host-key fingerprint when possible.
6. Log in with the account created during setup or a tested SSH key.
7. Run whoami and hostname to confirm the remote system.
8. Use exit when finished.