Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Install OpenSSH Server with sudo apt update and sudo apt install openssh-server, confirm that ssh.service is running, allow SSH through UFW before enabling the firewall, and then log in with an Ed25519 key. Make every sshd configuration change in a drop-in file when practical, test it with sudo sshd -t, and keep an existing session open while testing a new one.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you need before installing OpenSSH
You need an Ubuntu Server account with sudo privileges, the server’s reachable IP address or hostname, and a client computer from which to connect. If the server is remote, do not enable UFW until an SSH allow rule exists. Otherwise, the firewall can block the connection you are using to administer the machine.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Ubuntu releases can ship different OpenSSH and systemd defaults. Package versions, whether a service starts automatically, and support for particular hardware-backed authentication methods vary by release. Use the installed system’s manpages and package documentation when a release-specific behavior matters.
Install the OpenSSH server package
- Refresh Ubuntu’s package metadata:
sudo apt update - Install the server component:
sudo apt install openssh-server
The package installs the sshd daemon, its systemd service, and the server configuration under /etc/ssh/. Installing the package does not by itself prove that remote logins are possible: the daemon must be running, the account must be usable, network access must exist, and any firewall in the path must permit SSH.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Confirm that the SSH service is running
Inspect the service immediately after installation:
sudo systemctl status ssh.serviceLook for an active service state. If it is stopped, start it:
sudo systemctl start ssh.serviceIf the server should start the daemon automatically during boot, enable it:
sudo systemctl enable ssh.serviceSome Ubuntu releases or package configurations may activate the service during installation, while others may leave activation to the administrator. Checking the status rather than assuming a default avoids a false diagnosis later.
Allow SSH through Ubuntu’s firewall
UFW is Ubuntu’s default firewall configuration tool, and a fresh installation is initially disabled. If you use UFW, create the SSH rule before enforcing the firewall:
- Allow the SSH port:
sudo ufw allow 22- Enable UFW:
sudo ufw enable- Review the resulting rules and status:
sudo ufw statusThe allow 22 rule provides broad reachability to TCP port 22. That is the simplest way to avoid locking yourself out during initial setup, but it exposes the SSH listener to every network that can reach the server. After confirming that administration works, you can replace broad access with rules limited to the trusted source networks appropriate for your environment. Do not remove the only working SSH rule until an alternative path has been tested.
If UFW is not in use, inspect other controls instead: a cloud security group, router ACL, hosting-provider firewall, or another network policy can still block the connection even when ssh.service is healthy.
Make the first connection
From the client, connect using the server account and address:
ssh username@target_machineOn the first connection, SSH may ask you to confirm the server’s host key. Verify that the address is the intended server and accept the key only when you trust its origin. A successful login confirms several things at once: name or address resolution, network reachability, the listener, firewall policy, the account, and at least one authentication method.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
If the command fails, record the exact client error before changing configuration. “Connection refused,” “connection timed out,” and “permission denied” indicate different layers of the problem and should not be treated as interchangeable.
Free tools Windows power users keep installed
One-click scans. No signup required.
Set up public-key authentication
OpenSSH supports password, public-key, and Kerberos authentication. Public-key authentication is generally preferable for administration because the reusable account password is not sent for every login. The private key remains on the client; the server stores only the corresponding public key.
Generate an Ed25519 key pair
On the client computer, run:
ssh-keygen -t ed25519Ubuntu recommends Ed25519 because it offers a shorter key size and lower computational requirements. The command asks where to save the key and whether to protect it with a passphrase. Keep the default location unless you have a deliberate key-management plan, and set a strong passphrase. A passphrase limits the damage if someone obtains the private-key file.
RSA with a 4096-bit key is an alternative when compatibility requirements prevent Ed25519 use:
ssh-keygen -t rsa -b 4096Do not copy the private-key file to the server or share it with another administrator. Back it up through a protected method, and document how an emergency administrator can use a separate key if the primary key is lost.
Recommended Free Tools
Install the public key on the server
Copy the public key to the target account with:
ssh-copy-id username@target_machineThe command places the public key in the account’s SSH authorization file, normally ~/.ssh/authorized_keys. It may ask for the account password during this one-time installation. Afterwards, test a new login from the client while keeping the original session open.
Protect the key files and directory
The server must be able to read the account’s key files without treating them as writable by unrelated users. Check the account’s home directory, ~/.ssh, and authorized_keys if key authentication is rejected. Restrict access to the SSH directory and authorization file, and protect the client’s private key from other local users. Exact ownership and mode requirements can vary with the OpenSSH and Ubuntu release, so confirm them in the installed sshd documentation.
Choose authentication and recovery options
| Method | Operational characteristics | Protection and recovery considerations |
|---|---|---|
| Password | Simple to begin with and available when the account permits it. | Requires entering a reusable secret for each login. A strong password policy and a tested recovery account are important. |
| Ed25519 public key | Ubuntu’s recommended key algorithm; convenient for repeated administration once installed. | Protect the private key with a passphrase, keep a secure backup, and maintain a second authorized administrator key for recovery. |
| RSA 4096-bit public key | Compatibility alternative for clients or integrations that do not support Ed25519. | Protect and recover it like any other private key; use it only where compatibility requires it. |
| Kerberos | Supported by the OpenSSH server in environments that already operate Kerberos. | Requires integration with that environment and is not a drop-in replacement for a standalone Ubuntu server. |
| Public key plus FIDO/U2F factor | Adds a hardware-backed factor when the selected PAM/OpenSSH integration supports it. | Improves resistance to stolen passwords or keys, but requires compatible hardware, software integration, enrollment, and a documented spare-key recovery process. |
A FIDO2 security key is an optional extra factor, not a requirement for ordinary OpenSSH key login. Its exact behavior depends on the PAM and OpenSSH integration selected for the Ubuntu release.
Configure the SSH daemon safely
The main daemon configuration file is /etc/ssh/sshd_config. Ubuntu also loads files matching /etc/ssh/sshd_config.d/*.conf. For local changes, a small drop-in file under that directory is usually easier to review, back up, and remove than editing the vendor-managed main file.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Understand directive precedence
OpenSSH generally uses the first value set for a directive. Include ordering therefore matters: an earlier setting can win even when a later file appears to contain the value you want. Avoid contradictory settings scattered across the main file and several snippets. Before relying on a drop-in, inspect the effective configuration and the order in which the installed release includes files.
Make one change at a time
Typical administrative changes include selecting allowed authentication methods, adjusting the listening address or port, and controlling which accounts may log in. The safe workflow is the same regardless of the directive:
- Record the current working setting and make a backup of any file you will edit.
- Create or edit one clearly named file in
/etc/ssh/sshd_config.d/when a local override is appropriate. - Check that the directive is not already set earlier in the include order.
- Validate the complete configuration before asking systemd to reload or restart the daemon.
Do not disable password authentication until a new public-key login has succeeded from a separate terminal and a recovery path is available. A configuration that is secure in theory can still strand the only administrator if the key is missing, the account is disabled, or the client is not available.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validate before restarting OpenSSH
Run the daemon’s syntax check after every configuration edit:
sudo sshd -tNo output normally indicates that the syntax check passed. An error identifies a file, line, or invalid value that must be corrected before applying the change. Ubuntu specifically warns that a bad remote configuration can prevent sshd from starting or lock out the only administrator.
After a successful check, restart the service:
sudo systemctl restart ssh.serviceKeep the original SSH session open. From a second terminal, establish a fresh connection and verify the intended authentication method and account access. Only after that test succeeds should you close the original session or remove an older recovery method.
Diagnose a failed connection
Work from the outside in. The symptom usually identifies the layer that needs attention.
“Connection timed out”
- Confirm that the server address is correct and that the server is powered on and reachable.
- Check UFW and any upstream firewall or security-group rule.
- Confirm that the listener is permitted from the client’s network; a broad port-22 rule may work while a restricted source rule does not.
“Connection refused”
- On the server console or an existing session, run
sudo systemctl status ssh.service. - Start the service if it is stopped, then inspect the status again.
- If a recent edit preceded the failure, run
sudo sshd -tand correct the reported configuration error.
“Permission denied” after installing a key
- Confirm that the client is using the private key corresponding to the public key copied to the target account.
- Check that the username is correct and that the account is enabled and permitted to log in.
- Inspect ownership and permissions on the home directory,
~/.ssh, andauthorized_keys. - Review the daemon’s effective authentication settings and the key’s placement in the correct account.
Find the server-side reason in the journal
Follow the SSH service log while reproducing the problem from another terminal:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutesudo journalctl -fu ssh.serviceLook for messages about rejected users, unreadable key files, invalid directives, authentication-method restrictions, or firewall-independent network errors. Stop following the journal with Ctrl+C after collecting the relevant event. A log message is more useful when paired with the exact client command and the time of the failed attempt.
Configuration and firewall choices at a glance
| Decision | Option A | Option B | Trade-off |
|---|---|---|---|
| Configuration location | Edit /etc/ssh/sshd_config |
Use a file under /etc/ssh/sshd_config.d/ |
The main file is direct but can mix local and package settings; a drop-in is easier to isolate, review, and remove, provided include precedence is understood. |
| Firewall scope | Allow port 22 broadly with sudo ufw allow 22 |
Limit SSH to trusted source networks | Broad access is easier to reach during setup; source restrictions reduce exposure but can block legitimate administration when addresses change. |
| Authentication | Password login | Ed25519 public key | Password is initially convenient; a passphrase-protected key avoids repeatedly sending a reusable password and is the Ubuntu-recommended algorithm. |
| Additional factor | Public key alone | Public key plus FIDO/U2F integration | The extra factor can protect against stolen credentials, but adds hardware, enrollment, integration, and recovery requirements. |
Operational checklist after setup
- Package:
openssh-serveris installed after a successfulsudo apt update. - Service:
ssh.serviceis active, and boot-time enablement matches your operational requirement. - Network: UFW or the relevant upstream firewall permits the intended source networks before enforcement.
- Identity: At least one tested Ed25519 public key is installed for the correct account, with a passphrase-protected private key.
- Permissions: The account’s SSH directory and authorization file are owned and protected appropriately.
- Configuration: Local overrides are organized in the drop-in directory without contradictory earlier directives.
- Validation:
sudo sshd -tpasses before every restart. - Testing: A second terminal has completed a new login before the original session is closed.
- Recovery: A separate administrator key, console path, or other documented recovery route exists before restrictive changes are made.
- Monitoring: You know how to follow
sudo journalctl -fu ssh.servicewhen a login fails.
What changes between Ubuntu releases
The commands in this guide use Ubuntu’s standard package, systemd service, UFW, and OpenSSH paths, but release-specific behavior still matters. Package revisions can change defaults, service activation can differ, and hardware-key support depends on the installed OpenSSH and PAM components. Before changing an authentication or authorization directive, read the manpages on the target system and verify the effective configuration there. Treat a successful setup on one Ubuntu release as a procedure to verify, not as proof that every release has identical defaults.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
