How to Set Up OpenSSH Server for Remote Access on Linux

To set up OpenSSH Server for remote access on a Linux home server, install the server package, start and enable the SSH service, open port 22 in the firewall, and then switch to SSH keys. That gets you in from another device without relying on password-only logins. If you also want access from outside your home network, you’ll need router port forwarding or another way to reach the machine from the internet.

What you need before you start

• Admin access on the Linux server, usually through a local account with sudo rights or direct root access.
• A Linux system that supports OpenSSH server packages. Most common desktop and server distributions do.
• Another device you can use to test the connection, such as a laptop, desktop, or even another Linux machine.
• A network connection between the two devices if you’re testing on the same local network.
• If you plan to connect from outside your home network later, access to your router’s admin settings for port forwarding.

You do not need to change anything yet. The easiest way to set this up is to keep local access to the server while you configure SSH, then test the login from another machine before you rely on it.

Install the OpenSSH server package

1. Check whether the SSH server is already installed. On most Linux systems, the server daemon is sshd.

sshd -V

If that prints a version message or another response instead of “command not found,” the server component is present. If it is missing, install the package for your distribution.

2. Install the right package for your distro.

sudo apt update
sudo apt install openssh-server

sudo dnf install openssh-server

sudo pacman -S openssh

On Debian and Ubuntu, the package is usually openssh-server. On Fedora, it is also openssh-server. On Arch-based systems, the package name is openssh.

After installation, the system should have the sshd service available. If your package manager says it is already installed, you can move on to starting the service.

Start the SSH service and make it launch at boot

1. Start the SSH service.

sudo systemctl start ssh

On some distributions, the service name is sshd instead of ssh.

sudo systemctl start sshd

2. Enable the service so it starts after every reboot.

sudo systemctl enable ssh

sudo systemctl enable sshd

3. Confirm that the service is running and enabled.

systemctl status ssh

or

systemctl status sshd

You want to see that the service is active and enabled. If ssh does not exist on your system, try sshd; if neither command works, the package may not have installed correctly. Enabling the service at boot matters because you do not want remote access to disappear after a restart.

Open the firewall for SSH

1. Allow port 22 through the firewall on the server.

If you use UFW:

sudo ufw allow 22/tcp
sudo ufw status

If you use firewalld:

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload
sudo firewall-cmd --list-services

If you use another firewall tool, the rule you want is still the same: allow inbound TCP traffic on port 22, or allow the ssh service if the tool supports service names.

Only open router port forwarding if you truly need to connect from outside your home network. Exposing SSH to the internet increases the chance of unwanted login attempts, so do that only after key-based login is working.

2. If the server stays inside your local network, stop here and test from another device on the same network. If you want to reach it from outside your house, add a router rule that forwards an external port to the server’s internal IP address on port 22.
3. Before you set that forwarding rule, give the server a fixed local address, such as a static DHCP lease, so the rule does not break later.

If the server is behind a router or NAT, the firewall rule on the machine is not enough for outside access. The router has to pass the connection through to the server’s private IP address.

Connect from another computer

1. Find the server’s local IP address or hostname.

ip addr

Look for the address on the network interface you use, often something like 192.168.x.x or 10.x.x.x. If your router gives hostnames on the local network, you can also try the machine’s hostname instead of the numeric address.

2. From the other computer, connect with your Linux username and the server’s address.

ssh user@server-ip

For example:

ssh alice@192.168.1.50

The first time you connect, SSH will usually ask you to confirm the server’s host key fingerprint. That is normal. Read it carefully, accept it only if you expect to be connecting to your own machine, and then enter your account password when prompted. If the login works, you now have remote access over SSH.

If you are connecting from outside your home network, use the router’s public IP address or hostname from the other device, along with the forwarded port if you changed it.

Switch to SSH keys and test one clean login

1. Create a key pair on the client device if you do not already have one.

ssh-keygen -t ed25519

Accept the default file location unless you have a reason not to, and set a passphrase if you want an extra layer of protection.

2. Copy the public key to the server.

ssh-copy-id user@server-ip

If ssh-copy-id is not available, you can append the public key to ~/.ssh/authorized_keys on the server by hand.

3. Open a fresh terminal window and test a new login.

ssh user@server-ip

You should connect without typing the account password. If you set a key passphrase, you may be asked for that instead. Once you have confirmed key-based login works, you can tighten the server further by disabling password authentication in /etc/ssh/sshd_config, then restarting the SSH service.

Do not disable password authentication until you have confirmed that key login works. If you turn it off too early, you can lock yourself out.

If the key-based login succeeds, the server is set up for safer remote access. If it does not, leave password login enabled and fix the key setup before changing the server config.

Conclusion

At this point, your Linux machine should accept SSH connections, stay available after reboot, and let you log in with keys instead of passwords. If you also need access from outside your home network, finish by setting a router port-forwarding rule and confirming that your public connection still uses key-based login. After that, the main maintenance is simple: keep the system updated and recheck SSH access any time you change the firewall, hostname, or network settings. If you can connect from another machine with a key and the server stays up after a reboot, the setup worked.

Frequently Asked Questions

What port does OpenSSH use by default?

OpenSSH uses TCP port 22 by default. You can change it later in `sshd_config`, but port 22 is the usual starting point.

Should I disable password login after setting up keys?

Yes, if key-based login works reliably and you have confirmed you can still get in. Test a clean key login first, then turn off password authentication so password guessing is no longer an option.

Can I connect by hostname instead of IP address?

Yes, if your network resolves the hostname correctly. On a home network, that may work through your router or local DNS. If it does not, use the server’s IP address.

Do I need router port forwarding for local SSH access?

No. Port forwarding is only for reaching the server from outside your local network. For local use, the firewall rule on the server is usually enough.