Enable SSH on Raspberry Pi OS (Raspbian)

Learn how to enable SSH on Raspberry Pi OS, connect remotely, prepare a headless Pi, verify the service, troubleshoot connections, and secure remote access.

SSH (Secure Shell) provides encrypted remote command-line access to a Raspberry Pi. Instead of connecting a monitor, keyboard, and mouse, you can administer the Pi from another computer on the same network.

Current documentation generally calls the operating system Raspberry Pi OS. Older tutorials may call it Raspbian; the SSH procedures are largely the same.

What SSH is useful for

Headless administration: configure a Pi without a display or keyboard attached.
File transfer: use tools such as SCP or SFTP to copy files securely.
Remote programming: edit, run, and test software on the Pi.
Troubleshooting: inspect services, logs, storage, and network settings remotely.

The SSH client runs on your computer or mobile device. The SSH server, commonly called sshd, runs on the Raspberry Pi and accepts incoming connections.

Requirements

A Raspberry Pi with Raspberry Pi OS installed.
Network access through Ethernet or Wi-Fi.
A separate computer or mobile device with an SSH client. Linux, macOS, and current Windows installations commonly include an ssh command; graphical alternatives include PuTTY and other SSH clients.
A known Raspberry Pi username and password, or an SSH key pair.
The Pi's IP address or a hostname that your local network can resolve.

An IP address identifies the Pi on the network. A hostname is a readable device name that may be used instead. A local hostname ending in .local usually depends on mDNS, a local-network name-resolution system.

For background, review What Is Raspberry Pi and Computer Network Explained.

Ways to enable SSH

Method	When to use it	Where it is performed	Key considerations
Desktop configuration interface	The Pi is running with a monitor and desktop	Raspberry Pi Configuration	Easy for beginners; no reboot is normally required
Terminal configuration utility	You have local terminal access	`raspi-config`	Use Interface Options to activate SSH
Service manager commands	You want direct systemd control	Local or existing terminal session	Check, enable, start, or stop the `ssh` service
Raspberry Pi Imager customization	Preparing a new Pi for headless use	Another computer running Raspberry Pi Imager	Set credentials, network options, and SSH before writing the card
Boot-partition SSH marker file	Using a legacy or version-dependent headless workflow	The operating-system boot partition	Create an empty file named `ssh` with no extension

Enable SSH from the Raspberry Pi desktop

Open the Raspberry Pi menu.
Open Preferences and choose Raspberry Pi Configuration.
Open the Interfaces section or tab.
Set SSH to enabled and apply the change.

The SSH service can normally start immediately, so a reboot is not required. If the interface asks to restart or a later configuration change requires it, follow that prompt.

After enabling SSH, find the Pi's hostname or IP address and connect from another device as described below.

Enable SSH from the terminal

From a local terminal on the Pi, start the Raspberry Pi configuration utility:

sudo raspi-config

Choose Interface Options, select SSH, and confirm activation. Exit the utility when finished.

You can also manage the service directly with systemd, the service manager used by Raspberry Pi OS:

sudo systemctl enable --now ssh

enable --now configures SSH to start during future boots and starts it now. The service unit is commonly named ssh on Raspberry Pi OS. The status command should report that it is active and running.

`Enable SSH before the first boot for a headless setup`

A headless setup configures and uses the Pi without a monitor, keyboard, or mouse attached. SSH must be prepared before boot, and the Pi must also be able to join the network.

`Preferred method: Raspberry Pi Imager customization`

Use Raspberry Pi Imager to write Raspberry Pi OS to the storage card or drive.
Open its operating-system customization options before writing the media.
Set a username and a unique strong password, or configure an SSH public key when the available Imager workflow supports it.
Enable SSH.
Configure Wi-Fi if Ethernet will not be used. Set the correct wireless network name, password, wireless country, locale, and keyboard settings.
Write the operating system, insert the media into the Pi, and boot it.

For a fully headless first boot, the Pi needs usable credentials and network settings. Enabling SSH alone is not enough if the Pi cannot join the network or if no login account was created.

`Legacy boot-partition marker-file method`

As a legacy or version-dependent method, create an empty file named ssh with no filename extension in the operating-system's boot partition before the first boot:

ssh

Do not create ssh.txt. The file must be placed in the boot partition, not in the Linux root filesystem. This method only activates SSH; it does not create a user, set a password, or configure Wi-Fi. Those settings must be supplied separately. Raspberry Pi Imager customization is the preferred beginner workflow.

`Find the Raspberry Pi on the network`

`Use the hostname`

If local DNS or mDNS is available, use the configured hostname, often with a .local suffix:

ssh <username>@<hostname>.local

Replace the placeholders with the account name and hostname. Hostname resolution depends on the client and network; it is not guaranteed on every network.

`Check the router or DHCP list`

DHCP automatically assigns IP addresses. Open the router's connected-device, lease, or DHCP-client list and identify the Raspberry Pi by hostname or hardware address. Then use its assigned address.

`Use local access or network discovery`

If hostname resolution fails, use a directly attached display and terminal to run:

hostname -I

You can also use an appropriate local-network discovery tool from another device. Avoid scanning networks you do not own or administer.

A DHCP address may change after a reboot or lease renewal. A DHCP reservation in the router keeps the same address assigned to the Pi. A carefully configured static network address is another option, but it must not conflict with another device.

`Connect using an SSH client`

The standard connection format is:

ssh <username>@<raspberry-pi-ip>

For example:

ssh piuser@192.168.1.42

When connecting for the first time, the client displays the server's host-key fingerprint and asks whether to trust it. Confirm that the address belongs to the expected Raspberry Pi, preferably by checking the device locally or through a trusted network record, before accepting the key.

After confirmation, password authentication prompts for the Raspberry Pi account password. With key-based authentication, the client uses a private key stored on your device and the Pi checks the matching public key. The private key should remain secret and should be protected with a passphrase where practical.

SSH clients keep accepted server keys in a client-side file commonly called known_hosts. This record helps detect an unexpected change in a server's identity.

On systems without a built-in terminal SSH client, a graphical SSH application such as PuTTY can provide the same remote terminal function. Enter the Pi's hostname or IP address, port 22, username, and the appropriate password or private key.

`Verify SSH status and listening port`

Check whether the service is enabled and running:

sudo systemctl is-enabled ssh
sudo systemctl status ssh

The default SSH port is TCP 22. To confirm that the daemon is listening locally, use a socket-listing command such as:

sudo ss -ltnp | grep ':22'

A successful test from another machine is also important:

ssh <username>@<raspberry-pi-ip>

When startup or connection attempts fail, inspect recent service logs:

sudo journalctl -u ssh --no-pager -n 50

These logs can reveal configuration errors, failed starts, rejected authentication attempts, and other daemon events.

`Use SSH keys instead of password login`

An SSH key pair consists of a private key retained by the client and a public key installed for the Raspberry Pi account. The private key is not sent to the server.

Generate an Ed25519 key pair on the client:

ssh-keygen -t ed25519

Install the public key using a helper available on many Unix-like clients:

ssh-copy-id <username>@<raspberry-pi-ip>

Open a second terminal session and test key-based login while the current session remains available.
Only after the key login works should you consider disabling password authentication.

If the helper is unavailable, install the public-key contents in the account's ~/.ssh/authorized_keys file using a trusted method, then check ownership and permissions from local access.

Important: Do not disable password authentication before testing the key. A misplaced key or incorrect permissions can otherwise lock you out of remote access.

`Secure remote SSH access`

Use a unique, strong password and never keep default or shared credentials.
Prefer SSH keys for routine administration, with a passphrase-protected private key.
Keep Raspberry Pi OS and installed packages updated.
Avoid exposing port 22 directly to the public internet.
For access from outside the home network, prefer a VPN or another controlled private-access solution.
Use firewall rules, router restrictions, and network segmentation where appropriate.
Change or disable password authentication only after successful key-based login has been tested.

Changing SSH to a different port can reduce automated noise, but it is not a replacement for strong authentication, updates, firewall controls, and a VPN or other protected access path.

Port forwarding on a router makes a private device reachable from the internet and increases risk. Configure it only when you understand the exposure and have a strong security design.

`Disable SSH when it is not needed`

Disabling SSH reduces the Pi's attack surface when remote administration is unnecessary. From a terminal, stop the service and prevent it from starting automatically:

sudo systemctl disable --now ssh

You can also open sudo raspi-config, choose Interface Options, select SSH, and disable it. Re-enable the service later with:

sudo systemctl enable --now ssh

`SSH connection troubleshooting`

Symptom	Likely cause	How to check	Resolution
Connection refused	SSH is disabled, sshd is not running, or the address points to the wrong host	Check `sudo systemctl status ssh` locally and verify the address	Enable and start SSH; confirm the Pi's current IP address
Connection timed out	The Pi is offline, the address is wrong, or a firewall, guest network, or isolation policy blocks access	Check power, network membership, router leases, and whether both devices can communicate	Reconnect Ethernet or Wi-Fi, use the current address, and remove the network restriction
Hostname cannot be resolved	The hostname is wrong, mDNS is unavailable, or the Pi has not joined the network	Verify the hostname locally or in the router records	Use the IP address, correct the hostname, or configure working local name resolution
Permission denied	Wrong username or password, missing account, missing key, incorrect permissions, or disabled password login	Confirm the account, private key, `authorized_keys`, and authentication settings	Use the correct credentials or key; repair the account and key permissions through local administration
Host key verification failed	The Pi was reimaged, its host keys changed, or the address now belongs to another device	Confirm the device identity through trusted local access	After verification, remove or update only the matching old `known_hosts` entry; do not ignore an unexpected warning

`Practical headless connection example`

Write Raspberry Pi OS with Raspberry Pi Imager.
In customization, create the username, set a strong password or public key, enable SSH, configure Wi-Fi if needed, and set locale options.
Boot the Pi without attaching a display.
Find its hostname in the router's DHCP list or find its IP address.
Connect from Linux, macOS, or Windows Terminal:

ssh <username>@<raspberry-pi-ip>

Review the host-key prompt, verify the destination, accept the key, and authenticate with the password or configured private key.

Exam note: SSH encrypts the remote session, but enabling it does not automatically make the Pi secure. Credentials, host-key verification, software updates, and network exposure all matter.



        
                ← Apache Default Virtual Host
                Install Raspbian on a Raspberry Pi →