How to manage the SSH server service with systemctl

Changing the SSH server service state affects the access path administrators use to reach a host. On systemd systems, the service can be inactive while an SSH socket is still listening, so check both units before deciding whether the server is stopped, ready for maintenance, or still accepting new connections.

The OpenSSH server unit is commonly ssh.service on Debian and Ubuntu and sshd.service on RHEL, Fedora, openSUSE, and similar distributions. Use the real unit name from systemctl list-unit-files in later commands, and include the socket unit when the package enables socket activation.

Start, stop, reload, restart, enable, and disable actions have different effects. Runtime actions change the current daemon, boot actions change whether systemd starts the unit later, and socket actions decide whether new connections can trigger the daemon on demand. Keep a console path or existing SSH session available before stopping or restarting the service on a remote host.

Steps to manage the OpenSSH server service with systemctl:

Open a terminal on the SSH server with an account that can use sudo.

Keep an existing SSH session or console path open until service changes are verified from a separate session or console.

Identify the installed service and socket unit names.

$ systemctl list-unit-files ssh.service sshd.service ssh.socket sshd.socket --no-pager
UNIT FILE    STATE    PRESET
ssh.service  disabled enabled
sshd.service alias    -
ssh.socket   enabled  enabled

3 unit files listed.

Use ssh in later commands when ssh.service is the real unit; use sshd when the host provides sshd.service as the real service unit.

Check the current service state.

$ sudo systemctl status ssh --no-pager
○ ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/usr/lib/systemd/system/ssh.service; disabled; preset: enabled)
     Active: inactive (dead)
TriggeredBy: ● ssh.socket
       Docs: man:sshd(8)
             man:sshd_config(5)

An inactive service with TriggeredBy: ssh.socket can still accept new connections through the socket unit.

Check the socket state when socket activation is enabled.

$ sudo systemctl status ssh.socket --no-pager
● ssh.socket - OpenBSD Secure Shell server socket
     Loaded: loaded (/usr/lib/systemd/system/ssh.socket; enabled; preset: enabled)
     Active: active (listening) since Sat 2026-06-13 12:00:00 UTC; 5s ago
    Triggers: ● ssh.service
     Listen: 0.0.0.0:22 (Stream)
             [::]:22 (Stream)
##### snipped #####

A listening socket can start ssh.service on demand even when the service itself is not running.

Start the SSH service for the current boot.
```
$ sudo systemctl start ssh
```
Confirm that the service is active.
```
$ systemctl is-active ssh
active
```
Test the sshd configuration before reloading or restarting after a config edit.
```
$ sudo sshd -t
```
No output means the active OpenSSH server configuration parsed successfully.
Related: How to test SSH server configuration
Reload the SSH service after a validated configuration change.
```
$ sudo systemctl reload ssh
```
Use a restart instead when the unit does not support reload or when the change requires a full daemon restart.
Restart the SSH service when reload is not enough.
```
$ sudo systemctl restart ssh
```
A restart can interrupt new connection attempts and can block fresh logins if the daemon cannot start again.

Related: How to restart the SSH server service
Stop the SSH service for maintenance.
```
$ sudo systemctl stop ssh
Stopping 'ssh.service', but its triggering units are still active:
ssh.socket
```
Stopping only the service does not close a socket-activated listener while ssh.socket remains active.

Check the listener after stopping the service.

$ sudo ss --tcp --listen --numeric --processes "sport = :22"
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      4096         0.0.0.0:22        0.0.0.0:*    users:(("systemd",pid=1234,fd=51))
LISTEN 0      4096            [::]:22           [::]:*    users:(("systemd",pid=1234,fd=53))

The systemd process owns the listener when the socket, not the daemon, is accepting connections.

Disable socket activation when new SSH connections must stay blocked.
```
$ sudo systemctl disable --now ssh.socket
Removed '/etc/systemd/system/ssh.service.requires/ssh.socket'.
Removed '/etc/systemd/system/sockets.target.wants/ssh.socket'.
```
Disabling the socket can immediately block new remote logins on hosts that rely on socket activation.

Confirm that the socket is disabled.

$ systemctl is-enabled ssh.socket
disabled

Enable socket activation again when the host should listen through ssh.socket.

$ sudo systemctl enable --now ssh.socket
Created symlink '/etc/systemd/system/sockets.target.wants/ssh.socket' → '/usr/lib/systemd/system/ssh.socket'.
Created symlink '/etc/systemd/system/ssh.service.requires/ssh.socket' → '/usr/lib/systemd/system/ssh.socket'.

Enable and start the service when the daemon should run persistently after boot.

$ sudo systemctl enable --now ssh
Synchronizing state of ssh.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable ssh
Created symlink '/etc/systemd/system/sshd.service' → '/usr/lib/systemd/system/ssh.service'.
Created symlink '/etc/systemd/system/multi-user.target.wants/ssh.service' → '/usr/lib/systemd/system/ssh.service'.

Confirm the boot setting.
```
$ systemctl is-enabled ssh
enabled
```

View recent service logs after a start, reload, or restart.

$ sudo journalctl --unit=ssh.service --no-pager --lines=10
Jun 13 12:00:00 server systemd[1]: Stopping ssh.service - OpenBSD Secure Shell server...
Jun 13 12:00:00 server sshd[132]: Received signal 15; terminating.
Jun 13 12:00:00 server systemd[1]: ssh.service: Deactivated successfully.
Jun 13 12:00:00 server systemd[1]: Stopped ssh.service - OpenBSD Secure Shell server.
Jun 13 12:00:00 server systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Jun 13 12:00:00 server sshd[248]: Server listening on 0.0.0.0 port 22.
Jun 13 12:00:00 server sshd[248]: Server listening on :: port 22.
Jun 13 12:00:00 server systemd[1]: Started ssh.service - OpenBSD Secure Shell server.

Use the exact unit name discovered earlier, such as sshd.service, when the server package uses that name.

Verify the final service state.

$ sudo systemctl status ssh --no-pager
● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/usr/lib/systemd/system/ssh.service; enabled; preset: enabled)
     Active: active (running) since Sat 2026-06-13 12:00:00 UTC; 5s ago
 TriggeredBy: ● ssh.socket
       Docs: man:sshd(8)
             man:sshd_config(5)
   Main PID: 1234 (sshd)
##### snipped #####