How do you enable and secure SSH access in Proxmox VE?

SSH lets administrators manage Proxmox VE hosts and troubleshoot from the command line, which matters when the web interface is down or when something has to be automated. Proxmox ships with OpenSSH, so the work is mostly checking that it runs, hardening it and controlling who can get in.

Updated September 2026 · Mr.PlanB

Proxmox Backup Strategy Data Protection

Sections

Action Points

Guidance Blocks

Overview

Two commands tell you whether SSH is enabled and reachable:

1. Check that SSH is running: systemctl status sshd 2. Confirm it is listening on port 22: ss -tuln | grep :22

If SSH is inactive, start it with systemctl start sshd.

To harden the service, edit /etc/ssh/sshd_config and set the following:

Disable root login: PermitRootLogin no

Disable password authentication: PasswordAuthentication no

Restrict users: AllowUsers admin_user

Optionally change the default port: Port 2222

Reload SSH after the changes with systemctl reload sshd.

Create an administrative user that is not root and set up key-based authentication with ssh-keygen and ssh-copy-id. Check the .ssh permissions while you are there: 700 on the directory, 600 on authorized_keys.

Next come the firewall rules. In the Proxmox VE Firewall, add an ACCEPT rule for SSH from trusted IP addresses only. If you changed the port, change the firewall rule to match.

For more protection, install Fail2Ban against brute-force attempts, and consider two-factor authentication through the PAM modules.

You can also reach VMs over SSH. The VM needs an SSH server installed, working network configuration (bridged, routed, or NAT with port forwarding) and a firewall rule that allows port 22.

SSH hands over remote control of the host, so keep it on least-privilege access and key-based authentication, and keep an eye on the logs.

FAQs