SSH connection failures on a Raspberry Pi typically stem from the SSH service being disabled, incorrect network configuration, or firewall restrictions. Verify that the sshd daemon is active and listening on port 22, ensure the correct IP address is used, and check local firewall rules to allow incoming connections.
Verify SSH Service Status
The most common reason for an inability to connect via SSH is that the service is not running or has been explicitly disabled. On modern Raspberry Pi OS versions, the SSH server is often disabled by default for security reasons. You must first confirm whether the service is installed and currently active.
To check the status of the SSH daemon, open a terminal directly on the Raspberry Pi (using a monitor, keyboard, and mouse) or access it via another method like VNC if available. Run the following command to see the current state:
sudo systemctl status sshIf the output indicates that the service is inactive or disabled, you need to enable it. Use the following commands to start the service immediately and ensure it starts automatically on boot:
sudo systemctl enable ssh
sudo systemctl start sshAfter running these commands, verify the status again. The output should show "active (running)" with green text. If the service fails to start, check the journal logs for specific error messages using journalctl -u ssh. This will provide details on why the daemon could not initialize, such as missing host keys or permission issues.
Check Network Configuration and Connectivity
Even if the SSH service is running, network misconfigurations can prevent external devices from reaching the Raspberry Pi. Ensure that both the client device and the Raspberry Pi are connected to the same local network. If you are using Wi-Fi, verify that the Pi has obtained a valid IP address.
Use the hostname -I command in the terminal to display the IP address assigned to the Raspberry Pi. Note this address carefully. It is crucial to distinguish between IPv4 and IPv6 addresses; most standard SSH clients default to IPv4, so ensure you are using the correct IPv4 address.
You can test basic connectivity from your computer by pinging the Raspberry Pi's IP address. Open a terminal on your local machine and run:
ping <Raspberry_Pi_IP_Address>If the ping is successful, the network path is open. If the ping fails, there may be a network isolation issue, such as AP Isolation enabled on your Wi-Fi router, which prevents devices on the same wireless network from communicating with each other. In such cases, you may need to adjust your router settings or use a wired Ethernet connection.
Inspect Firewall Rules
Firewalls can block incoming SSH connections even when the service is active and the network is reachable. Raspberry Pi OS does not enable a firewall by default, but if you have installed one manually or are using a different operating system, it might be blocking port 22.
If you are using UFW (Uncomplicated Firewall), check its status with:
sudo ufw statusIf the status is active, ensure that traffic on port 22 is allowed. You can allow SSH traffic by running:
sudo ufw allow sshFor firewalld users, similar steps apply to open the SSH service zone. Always remember to reload the firewall configuration after making changes to ensure they take effect immediately.
Authentication and Key Issues
Once the service is running and the network is clear, authentication problems may arise. By default, Raspberry Pi OS allows password authentication. Ensure you are using the correct username (pi for older images, or the custom user created during setup for newer ones) and the correct password.
If you are using key-based authentication, verify that the public key is correctly added to the ~/.ssh/authorized_keys file on the Raspberry Pi. Check file permissions; the .ssh directory should have permissions 700, and the authorized_keys file should have permissions 600. Incorrect permissions will cause the SSH server to reject the key silently.
For detailed debugging, attempt to connect with verbose output from your client machine:
ssh -v pi@<Raspberry_Pi_IP_Address>This will show exactly where the connection process fails, whether at the network level, key exchange, or authentication stage.
Frequently Asked Questions
Why can I ping my Raspberry Pi but cannot SSH?
Ping uses ICMP protocol, while SSH uses TCP port 22. A successful ping only confirms network layer reachability, not application layer availability. The SSH service itself may be stopped, or a firewall may be blocking TCP port 22 specifically while allowing ICMP.
How do I enable SSH via command line without a GUI?
You can enable SSH remotely using the raspi-config tool. Run sudo raspi-config, navigate to Interface Options, select SSH, and choose Yes to enable it. Alternatively, simply create an empty file named ssh in the root directory of the boot partition if you have SD card access.
What should I do if SSH hangs during connection?
Hanging often indicates a network timeout or DNS resolution issue. Try connecting using the IP address instead of the hostname to rule out DNS problems. Also, check if your router has assigned a static lease to the Pi to prevent IP changes that might confuse persistent connections.
Can I change the default SSH port on Raspberry Pi?
Yes, you can change the port by editing /etc/ssh/sshd_config and modifying the Port directive. After changing the port, restart the SSH service. Remember to update your firewall rules and any client configurations to use the new port number.
Is it safe to disable password authentication for SSH?
Disabling password authentication and using only SSH keys is generally safer as it mitigates brute-force attacks. However, ensure you have a backup method to access the Pi, such as console access, in case you lose your private key or lock yourself out.