Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just installed Ubuntu. How do I set it up to allow me to ssh into it?

Right now I get "ssh: connect to host x.x.x.x port 22: Operation timed out".

share|improve this question
up vote 159 down vote accepted
sudo apt-get update
sudo apt-get install openssh-server
sudo ufw allow 22

That's the very minimum. It allows unlimited failed password attempts on a known port. Direct root-login is disabled (you can still su and sudo once logged in). If your username and password are guessable and the Internet can see the server, somebody will eventually break in.

You need to harden it from the standard setup. I've gone through several suggestions on my blog but at the very least, I'd suggest:

  • Key-based logins. Disable password logins.
  • Move it off port 22. Use something crazy-high, in the 20000-60000 range.
  • Use fail2ban to ban people who do find it and try to brute it.

They take about 10 minutes in total and you go from a 1/10000 chance of being broken in to a probability so small, there isn't enough paper in the world to write its fraction... Assuming you're careful with your key, it has a password of its own and you don't trumpet your credentials all over the net.

If the computer is behind a router, you'll also want to do some port forwarding. This is router-specific so I'll just direct you to

share|improve this answer
Depending on your instance, you may not need sudo ufw allow 22. For example, I've got a simple VirtualBox Ubuntu-Server instance up, with Bridged Networking on a Windows host (for simple dev needs) - no need for opening port 22 (already open), no need for hardening that would potentially close 22, no need to use different port. – Chris Moschini Mar 20 '14 at 4:02
@Oli - Can you exttend a bit on how fail2ban works? Do you just install it and it automagically starts a daemon for you or does it need configuration? – Matteo Oct 30 '15 at 18:55
@Matteo It ships with some defaults for common services (like SSH). In this case, unless you've made serious changes to where your logs are kept, just installing it should be enough. – Oli Oct 30 '15 at 21:10
@Oli - thanks a lot for your prompt reply! – Matteo Oct 30 '15 at 22:04
Just FYI sudo apt-get install ssh seems to be the same thing as openssh-server – Sridhar-Sarnobat Mar 20 at 4:52

Installing the openssh-server package which is available from the Software Center will provide the server element to allow a client such as another ubuntu desktop to achieve a secure connection to a 'server' such as your VM.

The ubuntu community has an excellent guide about SSH, OpenSSH-Server and how to configure it in a secure manner.

share|improve this answer

I just wanted to add that you need to make sure you have picked the correct WAN interface, if your modem/router support multiple WAN interfaces.

I have a Billion BiPAC 7800NXL which has 3 possible WAN ports (DSL, ETH and 3G). When you create a new forwards (called a "Virtual Server" in this router), the 7800NXL always defaults to the DSL WAN interface, even though I only use the Ethernet WAN interface.

I had all the ports set up correctly, but my forward was configured to use DSL, so it didn't work. As soon as I created a new forward for the ETH WAN interface, it worked.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.