How to Enable and Configure SSH on Debian 12 (Bookworm)

Are you setting up a Debian 12 (Bookworm) server and want to manage it remotely? Using SSH (Secure Shell) is one of the most secure and efficient ways to access your server without needing physical access. In this guide, I’ll walk you through enabling and configuring SSH on Debian 12, so you can establish a secure remote connection with ease. Let’s dive into the step-by-step process!

Prerequisites for Enabling SSH on Debian 12

System Requirements and Basic Setup

Before enabling SSH on Debian 12, there are a few prerequisites to ensure a smooth setup:

1. Permissions: You’ll need sudo privileges on the server to install and configure the SSH server.
2. Internet Access: Make sure your Debian 12 system is connected to the internet to download and install packages.
3. Up-to-Date System: Keep your Debian 12 installation current with the following commands:

bash

sudo apt update

sudo apt upgrade

Installing OpenSSH Server on Debian 12

To use SSH, you first need to install the OpenSSH server. OpenSSH is the most popular SSH implementation and offers a straightforward installation process on Debian 12.

bash

sudo apt install OpenSSH-server

This command installs OpenSSH on Debian 12, allowing you to establish an SSH connection. Once installed, you’re ready to start and verify the SSH service.

Starting and Verifying the SSH Service on Debian 12

Starting the SSH Service

To activate the SSH service, use the following command:

bash

sudo systemctl start ssh

To ensure SSH starts automatically with each system boot, enable it with:

bash

sudo systemctl enable ssh

Checking SSH Service Status

To confirm that the SSH service is running, check its status:

bash

sudo systemctl status ssh

If you see “active (running),” you’re good to go! This output confirms that your Debian 12 system is ready to accept SSH connections.

---

Configuring SSH for Enhanced Security on Debian 12

SSH is a secure protocol, but it’s wise to make a few configuration adjustments to enhance security further.

Modifying the SSH Configuration File

The SSH configuration file is located at /etc/ssh/sshd_config. Before making changes, back up the file with:

bash

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Open the configuration file with:

bash

sudo nano /etc/ssh/sshd_config

Changing the Default SSH Port

By default, SSH listens on port 22. Changing this port can help reduce exposure to automated attacks.

1. Find the line #Port 22 and change it to a custom port, such as Port 2222.

Save and close the file, then restart SSH:
bash

sudo systemctl restart ssh

Disabling Root Login for Security

To prevent unauthorized access to the root account, disable root login:

1. In /etc/ssh/sshd_config, find PermitRootLogin yes.
2. Change it to PermitRootLogin no.

Restart SSH to apply changes:
bash

sudo systemctl restart ssh

Setting Up Key-Based Authentication

Key-based authentication provides a secure alternative to password-based login. Here’s how to set it up:

Generate an SSH key pair on your client machine:
bash

ssh-keygen -t rsa -b 4096

Copy the public key to your server:
bash
ssh-copy-id username@server_ip -p <custom_port>

2. Disable password-based login in the SSH config file by setting PasswordAuthentication no in /etc/ssh/sshd_config, and restart the service.

Firewall Configuration for SSH Access on Debian 12

Allowing SSH Through UFW (Uncomplicated Firewall)

If you use UFW on Debian 12, allow SSH traffic by running:

bash

Copy code

sudo ufw allow <custom_port>/tcp

Reload UFW to apply changes:

bash

Copy code

sudo ufw reload

Alternative: Configuring IPTables for SSH Access

For advanced users, IPTables offers more control over firewall rules. To allow SSH access:

bash

Copy code

sudo iptables -A INPUT -p tcp –dport <custom_port> -j ACCEPT

To ensure persistence across reboots, save the rules with:

bash

Copy code

sudo iptables-save

---

Testing SSH Connection on Debian 12

Getting the Server’s IP Address

Identify your server’s IP address with:

bash

hostname -I

Connecting to Debian 12 via SSH from Another Machine

To connect from your local machine:

bash

ssh username@server_ip -p <custom_port>

For Windows, you can use tools like PuTTY.

Common SSH Commands for Managing Debian 12 Remotely

Here are some essential SSH commands for managing your server:

• File Transfer: Use scp to copy files between machines.
• Directory Navigation: cd, ls, and pwd are helpful for navigating directories remotely.
• File Editing: Use Nano or Vim to edit files directly over SSH.

To keep the connection alive during idle times, consider setting ClientAliveInterval in /etc/ssh/sshd_config.

Troubleshooting SSH on Debian 12

If you encounter issues connecting to SSH, here are some tips:

1. Connection Refused: Verify that SSH is running (sudo systemctl status ssh) and check firewall rules.
2. Host Key Verification Failed: Use ssh -v to get verbose output for debugging.

Restart SSH: If you make configuration changes, restart SSH:
bash
Copy code
sudo systemctl restart ssh

Hardening SSH Security on Debian 12

Enforcing a Stronger Encryption Algorithm

For stronger encryption, switch to ED25519 keys by updating the SSH config.

Limiting User Access to SSH

Allow only specific users by adding AllowUsers username to /etc/ssh/sshd_config.

Using Fail2ban to Prevent Brute-Force Attacks

Install Fail2ban to protect your SSH from brute-force attempts:

bash

sudo apt install fail2ban

Conclusion

Setting up SSH on Debian 12 is essential for remote management and maintaining a secure connection to your server. By following the steps in this guide to enable, configure, and secure SSH, you’ll ensure safe, reliable access to your Debian system.

FAQs

Q1: How do I enable SSH on Debian 12?
To enable SSH on Debian 12, install the OpenSSH server with sudo apt install openssh-server, start the service, and allow SSH traffic through your firewall.

Q2: Is SSH enabled by default on Debian 12?
No, SSH is not enabled by default on Debian 12. You need to install and start the OpenSSH server manually.

Q3: How do I change the SSH port on Debian 12?
Edit the SSH configuration file (/etc/ssh/sshd_config), change the Port directive to your desired port number, and restart the SSH service.

Q4: How do I set up key-based authentication for SSH?
Generate a key pair with ssh-keygen, copy the public key to your server with ssh-copy-id, and disable password authentication for extra security.Q5: What firewall rules should I configure for SSH on Debian 12?
Use sudo ufw allow ssh or a custom port to permit SSH access. For IPTables, add a rule to allow SSH traffic on your chosen port.