How to manage the SSH server service with systemctl in Linux

Managing the SSH server service keeps remote administration predictable during configuration changes, maintenance windows, and incident response. Quick status checks also help separate daemon failures from authentication, firewall, routing, or DNS problems.

On Linux systems that use systemd, the OpenSSH server runs as a unit managed by systemctl, commonly as ssh.service or sshd.service. Some installations also include a socket unit (ssh.socket or sshd.socket) that can start the daemon on demand, using the same systemctl lifecycle operations.

Service control requires administrator privileges and immediately affects remote access. Stopping or restarting the unit can terminate active sessions, and disabling a socket-activated setup can prevent new connections entirely. Configuration edits in /etc/ssh/sshd_config should be syntax-checked before a reload or restart, with a recovery path available for rollback.

Task	Command
Check status	systemctl status <unit>
Start service	systemctl start <unit>
Stop service	systemctl stop <unit>
Restart service	systemctl restart <unit>
Reload configuration	systemctl reload <unit>
Enable on boot	systemctl enable <unit>
Disable on boot	systemctl disable <unit>
Enable and start now	systemctl enable –now <unit>
Disable and stop now	systemctl disable –now <unit>
Show recent logs	journalctl –unit=<unit> –no-pager –lines=50

Steps to manage OpenSSH server service with systemctl in Linux:

Identify the installed OpenSSH server unit name.

$ systemctl list-unit-files --type=service | grep --extended-regexp '^(ssh|sshd)\.service'
ssh.service                                  enabled         enabled
sshd.service                                 alias           -

Use the unit name shown on the left in later commands.

Identify any installed SSH socket unit for on-demand activation.

$ systemctl list-unit-files --type=socket | grep --extended-regexp '^(ssh|sshd)\.socket'
ssh.socket                       enabled  enabled

No output indicates socket activation is not configured.

Check the SSH service status.

$ sudo systemctl status ssh --no-pager
● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/usr/lib/systemd/system/ssh.service; enabled; preset: enabled)
     Active: active (running) since Sat 2026-01-10 12:19:38 +08; 5min ago
TriggeredBy: ● ssh.socket
       Docs: man:sshd(8)
             man:sshd_config(5)
   Main PID: 10704 (sshd)
      Tasks: 1 (limit: 4546)
     Memory: 1.1M (peak: 19.4M)
        CPU: 150ms
     CGroup: /system.slice/ssh.service
             └─10704 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"
##### snipped #####

Replace ssh with sshd when the unit is sshd.service on the host.

Stop the SSH service.
```
$ sudo systemctl stop ssh
```
Stopping the service can disconnect active sessions and prevents new logins until the daemon is started again.
Start the SSH service.
```
$ sudo systemctl start ssh
```
Reload the SSH service to apply configuration changes without a full restart.
```
$ sudo systemctl reload ssh
```
If the unit does not support reload (or the reload fails), use a full restart instead.

Related: How to check and validate the SSH server configuration
Restart the SSH service to fully reinitialize the daemon.
```
$ sudo systemctl restart ssh
```
A restart can interrupt in-flight sessions if the daemon cannot rebind the listening socket quickly or the configuration changes break authentication.

Related: How to check and validate the SSH server configuration

Disable the SSH service from starting on boot.

$ sudo systemctl disable --now ssh
Synchronizing state of ssh.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install disable ssh
Removed "/etc/systemd/system/sshd.service".
Removed "/etc/systemd/system/multi-user.target.wants/ssh.service".
Disabling 'ssh.service', but its triggering units are still active:
ssh.socket
Stopping 'ssh.service', but its triggering units are still active:
ssh.socket

On socket-activated hosts, the service can still start on demand while the socket unit remains enabled.

Disable the SSH socket unit to prevent socket activation when ssh.socket or sshd.socket is enabled.
```
$ sudo systemctl disable --now ssh.socket
Removed "/etc/systemd/system/ssh.service.requires/ssh.socket".
Removed "/etc/systemd/system/sockets.target.wants/ssh.socket".
```
Disabling the socket stops listening for new SSH connections and can immediately block remote access.

Enable the SSH service to start on boot.

$ sudo systemctl enable --now ssh
Synchronizing state of ssh.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable ssh
Created symlink /etc/systemd/system/sshd.service → /usr/lib/systemd/system/ssh.service.
Created symlink /etc/systemd/system/multi-user.target.wants/ssh.service → /usr/lib/systemd/system/ssh.service.

Enable the SSH socket unit to restore socket activation when needed.

$ sudo systemctl enable --now ssh.socket
Created symlink /etc/systemd/system/sockets.target.wants/ssh.socket → /usr/lib/systemd/system/ssh.socket.
Created symlink /etc/systemd/system/ssh.service.requires/ssh.socket → /usr/lib/systemd/system/ssh.socket.

Enabling the socket reopens the listening port for new connections, even if the service is not started persistently.

View recent service logs when the unit shows failed or exits unexpectedly.

$ sudo journalctl --unit=ssh.service --no-pager --lines=50
Jan 10 12:19:38 host systemd[1]: Stopping ssh.service - OpenBSD Secure Shell server...
Jan 10 12:19:38 host systemd[1]: ssh.service: Deactivated successfully.
Jan 10 12:19:38 host systemd[1]: Stopped ssh.service - OpenBSD Secure Shell server.
Jan 10 12:19:38 host systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
##### snipped #####

Use the exact unit name discovered earlier, such as sshd.service.

Verify the current service state.
```
$ systemctl is-active ssh
active
```
Verify the start-on-boot setting.
```
$ systemctl is-enabled ssh
enabled
```

Verify the daemon is listening on the expected port.

$ sudo ss --tcp --listen --numeric --processes | grep --fixed-strings ':22'
LISTEN 0      4096         0.0.0.0:22         0.0.0.0:*    users:(("sshd",pid=13838,fd=3),("systemd",pid=1,fd=258))
LISTEN 0      4096            [::]:22            [::]:*    users:(("sshd",pid=13838,fd=4),("systemd",pid=1,fd=259))

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.