Prerequisites and User Setup
Before attempting any connection, verify that the non-root user account is properly configured on the Debian machine. If you are accessing the system via another method, such as console or existing root SSH, create the new user using theadduser command. For example, running sudo adduser myuser creates the account and prompts for a password. It is critical to assign this user to the sudo group if administrative privileges are needed later. Use sudo usermod -aG sudo myuser to achieve this. Without proper group membership, the user will not be able to escalate privileges after logging in.
Additionally, ensure the user’s home directory contains an authorized keys file if you plan to use key-based authentication in the future, though this guide focuses on password authentication for simplicity. Verify the user shell is set to /bin/bash or similar standard shell. You can check this with getent passwd myuser. If the shell is incorrect, update it using chsh -s /bin/bash myuser. A misconfigured shell can prevent successful login sessions even if credentials are correct.
Configuring the SSH Daemon
The core of the problem often lies in the SSH daemon configuration on Debian. By default, modern Debian versions disable root login via SSH for security reasons. However, they may also restrict other users depending on the installation profile. Open the main configuration file located at/etc/ssh/sshd_config using a text editor like nano or vim. Look for the directive PermitRootLogin. It should be set to no or prohibit-password. This ensures that attackers cannot brute-force the root account directly.
Next, locate the PasswordAuthentication directive. Ensure it is set to yes. If it is set to no, password-based logins for all users, including your non-root account, will fail. Some minimal installations might have this disabled by default. After making changes, save the file and exit the editor. It is vital to test the configuration syntax before restarting the service to avoid locking yourself out. Run sudo sshd -t to validate the config. If no output appears, the syntax is valid.
Restart the SSH service to apply changes using sudo systemctl restart ssh. Verify the service is active with systemctl status ssh. If the service fails to start, check the logs at /var/log/auth.log for errors. In some cases, firewall rules on Debian might block incoming connections on port 22. Ensure that UFW (Uncomplicated Firewall) allows SSH traffic by running sudo ufw allow ssh if necessary. Failure to open the port results in connection timeouts rather than authentication failures.
Connecting via Putty
With the server side prepared, switch to your Windows machine. Download and install PuTTY from the official website if not already present. Launch the application to see the connection configuration window. Enter the IP address or hostname of your Debian server in the "Host Name (or IP address)" field. Ensure the "Port" is set to22 and the "Connection type" is SSH. These settings are standard for most Linux servers. If you changed the port during configuration, adjust this value accordingly.
Click "Open" to initiate the connection. The first time connecting, PuTTY will display a security alert about the host key fingerprint. Review the fingerprint if possible, then click "Accept" to store it in the registry. This prevents man-in-the-middle attacks in future sessions. You will then be prompted for the login name. Enter the exact non-root username you created earlier, such as myuser. Do not use root unless explicitly allowed and necessary for troubleshooting.
After entering the username, press Enter. You will be asked for the password. Type the password carefully; PuTTY does not display characters for security reasons. Press Enter again. If the credentials are correct and the server configuration permits password auth, you will gain access to the command prompt. Test the session by running whoami to confirm you are logged in as the non-root user. If you receive a "Permission denied" error, double-check the username spelling and password. Common mistakes include typos or confusion between uppercase and lowercase letters.
For better workflow, save the session details. In the PuTTY configuration window, enter a name in the "Saved Sessions" box and click "Save". This allows quick reconnection without re-entering IP addresses. You can also enable logging under "Session" > "Logging" to capture session transcripts for debugging purposes. Refer to our guide on How to Enable Putty Logging with Tab Completion for SSH Sessions on Linux Systems for advanced logging techniques.
Troubleshooting Connection Issues
If the connection hangs, check network connectivity. Useping from Windows to the Debian IP to verify reachability. If ping works but SSH fails, inspect the firewall settings on both ends. On Debian, check iptables or nftables rules. On Windows, ensure outbound port 22 is not blocked by corporate firewalls or antivirus software.
If you get "Connection refused," the SSH service might not be running. Check with sudo systemctl status ssh on the server. If the service is inactive, start it with sudo systemctl start ssh. Persistent issues may require checking the /var/log/auth.log file on Debian for detailed rejection reasons. Sometimes, failed login attempts trigger temporary bans via fail2ban. Wait a few minutes or check the ban status with fail2ban-client status ssh.
Another common issue is DNS resolution if using a hostname instead of an IP. Ensure the Debian server can resolve the client’s hostname if reverse DNS is enforced, though this is rare for basic setups. For more complex networking scenarios involving IP aliases or hostnames, consult How to Access IP/Hostname on Windows using SSH Server to resolve naming conflicts.
Security Best Practices
While password authentication works, it is less secure than key-based methods. Consider setting up SSH keys for your non-root user to eliminate password entry risks. Generate a key pair on Windows using PuTTYgen, upload the public key to the Debian user’s~/.ssh/authorized_keys file, and then disable password authentication in sshd_config. This approach significantly reduces the attack surface against brute-force attacks. Always keep your PuTTY version updated to mitigate potential vulnerabilities in older releases. Regularly review user accounts and remove unused ones to maintain a clean and secure system environment.
Frequently Asked Questions
Why am I getting 'Permission Denied' when logging in?
This error usually indicates incorrect credentials or disabled authentication methods. Verify the username and password are typed correctly, paying attention to case sensitivity. Additionally, ensure that PasswordAuthentication yes is set in the Debian sshd_config file.
Can I log in as root using Putty on Debian?
No, modern Debian configurations typically disable root login via SSH for security reasons. You should log in as a standard user and use sudo for administrative tasks. Attempting to log in as root will result in immediate rejection by the SSH daemon.
What should I do if the connection times out?
A timeout suggests a network issue or firewall blocking. Check if the Debian server is reachable via ping. Verify that port 22 is open in the server’s firewall (UFW or iptables) and that no intermediate network devices are blocking the traffic.
How can I switch to root after logging in as a non-root user?
Use the sudo su or sudo -i command after authenticating with your non-root password. This requires the user to be in the sudo group. Never attempt to log in directly as root; always elevate privileges within the session.
Is it safe to use password authentication for SSH?
Password authentication is less secure than key-based authentication because passwords can be guessed or intercepted. While acceptable for internal networks, it is recommended to use SSH keys for production environments to enhance security against brute-force attacks.