How to install an SSH server on Debian

Minimal Debian installations do not always include a daemon for inbound SSH logins. Installing the OpenSSH server package gives administrators a managed sshd service, generated host keys, and a standard port 22 listener that can be checked before remote access depends on it.

Debian provides the server through the openssh-server package from the enabled APT repositories. The package installs /usr/sbin/sshd, adds the systemd unit ssh.service, keeps sshd.service as an alias, and uses /etc/ssh/sshd_config plus included files under /etc/ssh/sshd_config.d/ for daemon settings.

Remote login still depends on a permitted user account, an authentication method, network reachability, and any local or cloud firewall in front of the host. Treat the install as complete only after the package is present, the ssh unit is active, the daemon parses its configuration, port 22 is listening, and a separate client can run a test command over SSH.

1. Open a terminal on the Debian host with an account that can use sudo.

   $ whoami
   admin

   Use How to add a sudo user on Debian first if the account cannot run privileged package and service commands.

2. Refresh the local APT package index.

   $ sudo apt update

3. Install the OpenSSH server package.

   $ sudo apt install openssh-server

   The package also pulls in the OpenSSH client and SFTP helper packages when they are not already installed.

4. Confirm that the server package is installed.

   $ dpkg-query -W openssh-server
   openssh-server  1:10.0p1-7+deb13u4

   The exact package revision changes with Debian point releases and security updates. The important result is that openssh-server is listed by dpkg-query.

5. Enable the Debian ssh service at boot and start it now.

   $ sudo systemctl enable --now ssh

   Debian uses ssh.service as the packaged service name. The sshd.service alias exists for compatibility, but using ssh keeps commands aligned with the packaged unit.

   Related: How to manage the SSH server service with systemctl

6. Validate the packaged sshd configuration.

   $ sudo sshd -t

   No output means sshd parsed /etc/ssh/sshd_config, included drop-ins, and host-key references successfully.

   Related: How to test SSH server configuration

7. Confirm that the SSH service is active.

   $ systemctl is-active ssh
   active

8. Confirm that the daemon is listening for inbound SSH connections.

   $ sudo ss -ltnp 'sport = :ssh'
   State  Recv-Q Send-Q Local Address:Port Peer Address:Port Process
   LISTEN 0      4096         0.0.0.0:22      0.0.0.0:*     users:(("sshd",pid=1402,fd=3))
   LISTEN 0      4096            [::]:22         [::]:*     users:(("sshd",pid=1402,fd=4))

   A listener on port 22 proves that the daemon is ready locally. Remote clients still need firewall and network rules that allow TCP port 22 to reach this host.

9. If the host uses UFW, allow inbound SSH traffic.

   $ sudo ufw allow 22/tcp
   Rule added
   Rule added (v6)

   Skip this step when UFW is not installed or another firewall stack controls the host. Apply the equivalent TCP port 22 rule in nftables, iptables, a cloud security group, or the network firewall when that layer is authoritative. Related: How to enable UFW on Debian

10. Record the server host-key fingerprint for first-connection verification.

    $ ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
    256 SHA256:W8JdNBQbOLbfHYW4TeYr5i2x95TaTYG9MTc/q4FJZYc root@debian-host (ED25519)

    Share the fingerprint through a trusted channel so users can compare it with the first SSH prompt instead of accepting an unknown host key blindly. Related: How to verify SSH host key fingerprints before connecting
    Tool: SSH Key Fingerprint Checker

11. Test a login from a separate client using an account that is allowed to authenticate.

    $ ssh admin@server.example.net hostname
    debian-host

    A successful remote command proves that package installation, service state, listener reachability, account access, and authentication all line up for real SSH use. Related: How to log in to an SSH server from Linux