The Modern Reality of Raspberry Pi SSH Access

If you are researching how to SSH into a Raspberry Pi, you are likely building a headless smart home node, a Pi-hole DNS server, or a Home Assistant bridge. Secure Shell (SSH) allows you to control your single-board computer over the network without needing a dedicated monitor, keyboard, or mouse. This headless approach saves desk space and eliminates the need for expensive micro-HDMI cables or peripherals.

However, the landscape of Raspberry Pi OS has changed dramatically over the last few years. The days of simply booting the Pi and logging in with the default username pi and password raspberry are over. In April 2022, the Raspberry Pi Foundation deprecated the default user account to improve out-of-the-box security. Furthermore, with the release of Raspberry Pi OS Bookworm, the boot partition structure has shifted. This guide will walk you through the exact, up-to-date methodology for establishing a secure SSH connection to your Raspberry Pi 4, Pi 5, or Pi Zero 2 W.

Prerequisites: Preparing Your Custom User

Before you can connect via SSH, you must have a valid user account configured on the device. Because the default pi user no longer exists, you must create a custom username and password during the OS flashing process.

  1. Download and open the official Raspberry Pi Imager.
  2. Select your specific hardware (e.g., Raspberry Pi 5) and choose Raspberry Pi OS (64-bit).
  3. Click the gear icon (or press Ctrl+Shift+X) to open the Advanced Options menu.
  4. Check the box for Set username and password and create your custom credentials (e.g., username: fluxadmin).
  5. Crucially, check the box to Enable SSH and select Use password authentication for now. (We will upgrade to key-based authentication later in this guide).

Flash the SD card, insert it into your Pi, and apply power. The Pi will boot, connect to your configured Wi-Fi or Ethernet, and start the SSH daemon automatically.

The Manual Method: Enabling SSH on a Headless Boot

If you have already flashed your SD card without using the Imager's advanced settings, or if you are cloning an existing drive, SSH is disabled by default. You can force the SSH daemon to start by creating a specific file on the boot partition.

Insert the SD card into your PC or Mac. Navigate to the boot partition. Note: On newer Bookworm releases, this partition is named bootfs and the system directory is /boot/firmware/, whereas older Bullseye releases used /boot/.

  • Create an empty text file named exactly ssh (no .txt extension).
  • Place this file directly in the root directory of the boot partition.
  • Safely eject the SD card, insert it into the Pi, and power it on. Upon detecting the file, the OS will enable the SSH service, move the file to /etc/ssh/, and delete it from the boot partition to prevent security loops.

Step 1: Locating Your Pi on the Local Network

To initiate an SSH session, you need the Pi's IP address or its mDNS hostname. Modern Raspberry Pi OS supports multicast DNS (mDNS) out of the box, which means you can often bypass IP hunting entirely.

Method A: The mDNS Hostname (Easiest)

By default, the Pi broadcasts itself on the local network as raspberrypi.local. If you have multiple Pis, you should change the hostname via the Imager settings to something unique like pi-hole.local or ha-node.local.

Method B: Finding the IP Address

If mDNS fails (common on some Windows machines without Bonjour Print Services installed), you must find the assigned IPv4 address. You can do this by:

  • Logging into your router's admin panel and checking the DHCP Client Lease table.
  • Using a free network scanning tool like Advanced IP Scanner (Windows) or Fing (iOS/Android).
  • Looking for a device with the MAC address vendor listed as "Raspberry Pi Foundation".

Step 2: Executing the SSH Command

With your custom username and the IP address (or .local hostname) in hand, you are ready to connect. Open your terminal: Command Prompt / PowerShell on Windows 10/11, or Terminal on macOS and Linux.

Type the following command, replacing the placeholders with your actual data:

ssh your_custom_username@raspberrypi.local

Or, using an IP address:

ssh your_custom_username@192.168.1.45

Handling the ECDSA Fingerprint Warning

Upon your first connection, the terminal will halt and display a security warning:

The authenticity of host '192.168.1.45' can't be established. ED25519 key fingerprint is SHA256:xyz123... Are you sure you want to continue connecting (yes/no/[fingerprint])?

This is standard SSH behavior. The Pi is presenting its cryptographic host key. Type yes and press Enter. Your computer will save this key in the ~/.ssh/known_hosts file. You will then be prompted to enter the custom password you created in the Raspberry Pi Imager. Note that the terminal will not display asterisks while you type the password; just type it blindly and press Enter.

Troubleshooting Common SSH Connection Errors

Network configurations and OS updates can occasionally block your connection. Refer to this diagnostic matrix to resolve common roadblocks.

Error Message Root Cause Solution
Connection refused The SSH daemon is not running, or the port is blocked. Verify the ssh file was placed in the correct boot partition. If you have monitor access, run sudo raspi-config -> Interface Options -> SSH -> Enable.
Network is unreachable or Request timed out Your PC and Pi are on different subnets, or the Pi has no network access. Check your router's DHCP table. Ensure the Pi is connected to the 2.4GHz Wi-Fi band if using a Pi Zero W, as it lacks 5GHz support.
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! You re-flashed the Pi's SD card, generating a new host key, but your PC remembers the old one. Run ssh-keygen -R raspberrypi.local (or the specific IP) in your PC's terminal to purge the old key from your known_hosts file, then reconnect.
Permission denied (publickey,password) Incorrect password, or password auth is disabled in sshd_config. Double-check your custom username. Ensure you are not trying to use the deprecated pi username.

Upgrading to SSH Key Authentication (Highly Recommended)

While password authentication is fine for initial setup, relying on passwords for long-term smart home nodes exposes your network to brute-force attacks. According to the Raspberry Pi Official Remote Access Documentation, setting up SSH key pairs is the gold standard for securing headless SBCs.

Step 1: Generate an Ed25519 Key Pair on Your PC

On your main computer (not the Pi), open your terminal and generate a modern Ed25519 key pair. This algorithm is faster and more secure than legacy RSA keys.

ssh-keygen -t ed25519 -C "pi-smart-home-node"

Press Enter to accept the default save location. When asked for a passphrase, you can press Enter to leave it blank for automated scripts, or type a passphrase for maximum security.

Step 2: Copy the Public Key to the Pi

If you are on macOS or Linux, use the built-in copy tool:

ssh-copy-id your_custom_username@raspberrypi.local

If you are on Windows, you can manually append the contents of your id_ed25519.pub file (located in C:\Users\YourName\.ssh\) to the Pi. Log into the Pi via password, create the SSH directory, and paste the key:

mkdir -p ~/.ssh
nano ~/.ssh/authorized_keys
# Paste your public key here, save (Ctrl+O), and exit (Ctrl+X)
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Step 3: Disable Password Authentication

Once you have verified that you can log in using your SSH key without a password prompt, lock the door behind you. Edit the SSH daemon configuration file on the Pi:

sudo nano /etc/ssh/sshd_config

Find the line that says #PasswordAuthentication yes, uncomment it by removing the #, and change it to:

PasswordAuthentication no

Finally, restart the SSH service to apply the changes:

sudo systemctl restart ssh

You now have a rock-solid, headless connection to your Raspberry Pi. For further reading on managing SSH keys and securing Linux environments, the SSH Keygen Academy provides excellent deep-dives into cryptographic key management.

Summary of Best Practices for 2026 and Beyond

Mastering how to SSH into a Raspberry Pi is the foundational skill for any SBC enthusiast. By utilizing the Raspberry Pi Imager to inject custom users and SSH configurations before the first boot, leveraging mDNS for easy network discovery, and hardening your daemon with Ed25519 key authentication, you ensure your DIY electronics projects remain both accessible to you and invisible to malicious actors on your local network.