Why SSH is Disabled by Default

If you are wondering how to enable SSH Raspberry Pi connections, you are likely transitioning from local monitor setups to remote, headless deployments. Secure Shell (SSH) is the backbone of remote Single Board Computer (SBC) management, allowing you to execute terminal commands, transfer files via SFTP, and tunnel services like Home Assistant dashboards. However, since late 2016, the Raspberry Pi Foundation has shipped Raspberry Pi OS with SSH disabled by default.

This security measure was implemented to prevent botnets (like the infamous Mirai malware) from hijacking default-credential devices exposed to the internet. To regain remote access, you must explicitly whitelist SSH. Below is a comprehensive software walkthrough detailing the three primary methods to activate the SSH daemon, adapted for the latest Debian-based Bookworm releases, alongside crucial hardening steps to keep your network secure.

Method 1: The Headless Boot Partition Trick

The headless method is essential when you are deploying a Raspberry Pi Zero 2 W or a Pi 5 in a remote location without a monitor, keyboard, or mouse. By placing a specific dummy file on the boot partition of your microSD card, the OS will detect it during the first boot sequence and automatically enable the SSH service.

Handling the Bookworm Path Change

A critical point of failure for many legacy tutorials is the directory structure change introduced in Raspberry Pi OS Bookworm (Debian 12). In older releases (Bullseye and earlier), the boot partition was mounted at /boot/. In Bookworm, the firmware and boot files are strictly separated, and the correct path is now /boot/firmware/.

To execute this on your host machine (Windows, macOS, or Linux) after flashing your SD card:

  1. Open the file explorer and navigate to the drive labeled bootfs.
  2. Create a new, completely empty file named exactly ssh. Do not add any file extensions.
  3. Eject the SD card safely and insert it into your Pi.

Windows Warning: Windows often hides known file extensions by default. If you create a file named ssh, Windows might silently save it as ssh.txt. To prevent this, open File Explorer, click the View tab, and check the box for File name extensions before creating your dummy file.

Pre-configuring Wi-Fi for True Headless Deployment

If your Pi relies on Wi-Fi rather than Ethernet, SSH is useless if the device cannot reach your router. In the same bootfs directory, create a wpa_supplicant.conf file containing your network credentials. Note that on Bookworm, NetworkManager is replacing wpa_supplicant, making the Raspberry Pi Imager (Method 2) the vastly superior choice for Wi-Fi provisioning.

Method 2: Raspberry Pi Imager OS Customization

The most robust and modern way to handle remote access provisioning is via the Raspberry Pi Imager. This software injects your configuration directly into the OS image before it is even flashed to the SD card, bypassing the need for dummy files entirely.

  1. Open Raspberry Pi Imager and select your hardware model and preferred OS (e.g., Raspberry Pi OS Lite 64-bit).
  2. Select your target microSD card.
  3. Click the Edit Settings button (or press Ctrl+Shift+X) to open the OS Customisation menu.
  4. Navigate to the Services tab.
  5. Check the box for Enable SSH.
  6. Choose your authentication method: Use password authentication (easier for beginners) or Allow public-key authentication only (highly recommended for security).

When you flash the image with these settings applied, the Pi will boot directly onto your network with SSH active and your Wi-Fi credentials pre-loaded.

Method 3: Desktop GUI and Terminal Toggles

If you are already sitting in front of your Pi with a connected monitor and keyboard, or if you are setting up a kiosk-style desktop environment, you can toggle the SSH daemon manually.

Using raspi-config in the Terminal

Open your terminal and launch the configuration utility with elevated privileges:

sudo raspi-config

Navigate using the arrow keys to 3 Interface Options > I1 SSH. Select <Yes> when asked if you wish to enable the SSH server. The daemon will start immediately.

Navigating the Desktop GUI

For those running the full desktop environment, click the Raspberry Pi logo in the top left corner. Go to Preferences > Raspberry Pi Configuration. Click on the Interfaces tab and toggle the SSH radio button to Enabled. Click OK, and the service will restart in the background.

Comparison of SSH Activation Methods

Method Best Use Case Requires Monitor? Persists Across Reflashes?
Boot Partition File Quick headless Ethernet deployments No No (Must recreate file)
Pi Imager Settings Headless Wi-Fi & Enterprise setups No Yes (Saved in Imager profile)
raspi-config / GUI Local desktop or kiosk configurations Yes Yes (Saved in OS state)

Hardening Your SSH Connection

Knowing how to enable SSH Raspberry Pi services is only half the battle; securing the open port is mandatory, especially if you plan to use port forwarding to access your Pi from outside your local network. The official Raspberry Pi Remote Access Documentation heavily advises against relying on password-based authentication.

Generating and Deploying Ed25519 Keys

ED25519 is the modern standard for SSH keys, offering superior security and faster handshake times compared to legacy RSA keys. On your host machine (not the Pi), generate a key pair:

ssh-keygen -t ed25519 -C "pi@home-lab"

Once generated, push the public key to your Pi using the ssh-copy-id utility:

ssh-copy-id -i ~/.ssh/id_ed25519.pub username@raspberrypi.local

Disabling Password Authentication

After verifying that your SSH key successfully logs you in without prompting for a password, you must disable password logins entirely to block brute-force attacks. Edit the SSH daemon configuration file:

sudo nano /etc/ssh/sshd_config

Locate the line containing #PasswordAuthentication yes. Remove the hash (#) to uncomment it, and change the value to no:

PasswordAuthentication no

For a deeper understanding of available daemon parameters, refer to the sshd_config Linux manual page. Save the file (Ctrl+O, Enter, Ctrl+X) and restart the service to apply the changes:

sudo systemctl restart ssh

Troubleshooting Connection Refused Errors

Even with SSH enabled, network topologies and OS quirks can cause connection failures. Here is a diagnostic framework for the most common errors:

  • Connection Refused (Port 22): This means the Pi is reachable, but the SSH daemon is not running or is blocked by a firewall. Verify the service status via a local terminal using sudo systemctl status ssh. If you are using UFW (Uncomplicated Firewall), ensure you have run sudo ufw allow ssh.
  • Could Not Resolve Host (raspberrypi.local): mDNS (Multicast DNS) relies on your router and host OS supporting Bonjour/Avahi. If .local fails, you must find the Pi's raw IP address. Use a network scanner like nmap -sn 192.168.1.0/24 or check your router's DHCP client list to find the exact IPv4 address.
  • Host Key Verification Failed: This occurs when you reflash your Pi's SD card with a new OS, but your host computer remembers the old cryptographic fingerprint for that IP address. The SSH client blocks the connection to prevent Man-in-the-Middle (MitM) attacks. Clear the old fingerprint from your known_hosts file by running: ssh-keygen -R 192.168.1.XX (replacing XX with your Pi's IP).
  • Permission Denied (publickey): If you disabled password authentication but your key isn't accepted, check the permissions on the Pi's .ssh directory. The directory must be 700 and the authorized_keys file must be 600. Fix this via local access using chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys.

By mastering these activation methods and security protocols, you transform your Raspberry Pi from a simple hobbyist board into a resilient, remotely manageable node capable of anchoring complex smart home and edge-computing networks.