I recently liberated an old model B from the loft, put NOOBS on an SD card, and installed the latest version of Raspbian on it. I booted it up, attempted to SSH to it from my Mac, but got:

ssh: connect to host port 22: Connection refused

I got around this in the first instance by running sudo ssh restart, but now every time I boot up again, I have to restart the ssh service before I can ssh in again, which obviously isn't practical. Anything I can do to fix it more permanently?


5 Answers 5


Quoting the documentation:

As of the November 2016 release, Raspbian has the SSH server disabled by default. You will have to enable it manually.

To enable SSH on machines through console:

Enter sudo raspi-config in the terminal, first select Interfacing Options, then navigate to ssh, press Enter and select Enable or disable ssh server.

To enable SSH for headless machines:

For headless setup, SSH can be enabled by placing a file named ssh, without any extension, onto the boot partition of the SD card.

  • 8
    I tried the headless setup on Raspbian Stretch Desktop from 2018-03-14 and it doesn't seem to be working anymore, was working with previous versions.
    – JBaczuk
    Commented Apr 3, 2018 at 18:36
  • 1
    Same problem here with headless creating the ssh file on boot doesn't seem to work even when the message is displayed on boot Commented Apr 15, 2018 at 16:59
  • @JBaczuk I'm experiencing the same thing. Have you fixed it yet?
    – Aaron
    Commented Apr 19, 2018 at 15:13
  • @JBaczuk It's now located under "interfacing options" (source: raspberrypi.org/forums/viewtopic.php?t=177883)
    – Aaron
    Commented Apr 19, 2018 at 15:30
  • @Aaron, ok, but how do you do this with a headless setup?
    – JBaczuk
    Commented Apr 19, 2018 at 15:32

There has recently been a security update for Raspberry Pi. Here is an article from https://www.raspberrypi.org/blog/a-security-update-for-raspbian-pixel/

From the foundation's article:

What has changed?

First, from now on SSH will be disabled by default on our images. SSH (Secure SHell) is a networking protocol which allows you to remotely log into a Linux computer and control it from a remote command line. As mentioned above, many Pi owners use it to install a Pi headless (without screen or keyboard) and control it from another PC.

In the past, SSH was enabled by default, so people using their Pi headless could easily update their SD card to a new image. Switching SSH on or off has always required the use of raspi-config or the Raspberry Pi Configuration application, but to access those, you need a screen and keyboard connected to the Pi itself, which is not the case in headless applications. So we’ve provided a simple mechanism for enabling SSH before an image is booted.

The boot partition on a Pi should be accessible from any machine with an SD card reader, on Windows, Mac, or Linux. If you want to enable SSH, all you need to do is to put a file called ssh in the /boot/ directory. The contents of the file don’t matter: it can contain any text you like, or even nothing at all. When the Pi boots, it looks for this file; if it finds it, it enables SSH and then deletes the file. SSH can still be turned on or off from the Raspberry Pi Configuration application or raspi-config; this is simply an additional way to turn it on if you can’t easily run either of those applications.

The risk with an open SSH port is that someone can access it and log in; to do this, they need a user account and a password. Out of the box, all Raspbian installs have the default user account ‘pi’ with the password ‘raspberry’. If you’re enabling SSH, you should really change the password for the ‘pi’ user to prevent a hacker using the defaults. To encourage this, we’ve added warnings to the boot process. If SSH is enabled, and the password for the ‘pi’ user is still ‘raspberry’, you’ll see a warning message whenever you boot the Pi, whether to the desktop or the command line. We’re not enforcing password changes, but you’ll be warned whenever you boot if your Pi is potentially at risk.

Our hope is that these (relatively minor) changes will not cause too much inconvenience, but they will make it much harder for hackers to attack the Pi.

What this basically means is that there has recently been lots of hacking of devices using remote connection like SSH. Due to this, SSH is by default turned disabled. To fix this all you have to do is create a file called ssh in the /boot/ directory. This file called ssh can contain any text or nothing if you want. Then, using the sudo raspi-config command on the terminal you can enable ssh again.

Also, it recommends you change your password if it was something simple like password to something more difficult to crack using the passwd command.

  • 2
    "there has recently been lots of hacking of devices" -> Probably a lot of people heard about this. Although Pis likely weren't involved, they might as well have been since running SSH by default with open access to a very privileged account via a "factory preset" password is exactly the kind of thing that was exploited.
    – goldilocks
    Commented Dec 19, 2016 at 16:54
  • 1
    The attacks are hardly "recent". I've been seeing break-in attempts in my logs for about three years now.
    – Mark
    Commented Dec 22, 2016 at 1:35
  • Maybe not a lot but there has been some hacking of Raspberry Pis! Commented Jan 11, 2017 at 18:59

I was getting Permission denied (publickey,password).

It turns out that for headless setups there is now a new step on top of creating the ssh enabling file: you need to setup the user enabling file.

If that helps someone that does not have a Linux installation available, here is the result of the command

echo 'raspberry' | openssl passwd -6 -stdin


  • Thanks, this was the solution for me - on opening an SSH connection, I was getting a warning saying, Please note that SSH may not work until a valid user has been set up. Note: as per the linked instructions, the password hash needs to be appended to the desired username, separated by a colon, e.g. john:$6$w....
    – mwfearnley
    Commented Jun 12, 2023 at 9:35
  • @mwfearnley this is so annoying forums.raspberrypi.com/viewtopic.php?t=345941
    – Pablo
    Commented Feb 2 at 22:40

systemctl solution

If you already have a shell on the Pi through a non-SSH method such as screen + keyboard or UART (see this post), you can also just run:

sudo systemctl enable ssh
sudo service sshd start

instead of doing it interactively through sudo raspi-config.

/boot/ssh magic file

If you don't have a shell on the Pi yet, insert he SD card on your host, and create a magic empty file named ssh file in the boot/ partition (the first one).

On Ubuntu hosts, it gets mounted automatically and you can do just:

sudo touch /media/$USER/boot/ssh

which you can confirm with:


which contains:

mmcblk0     179:0    0  14.4G  0 disk
├─mmcblk0p1 179:1    0  43.9M  0 part /media/ciro/boot
└─mmcblk0p2 179:2    0  14.4G  0 part /media/ciro/rootfs

Tested on Raspbian Lite 2018-11-13, full test setup described further at: SSH to RPi without a network connection?


Yes, as @tecraf said ssh is disabled by default, but the configuration location has changed. To enable SSH on your machine through console:

Enter sudo raspi-config in the terminal go to 5-Interfacing Options, then navigate to P2-ssh, press Enter and use tab to enable or disable ssh server. Then sudo shutdown -r now to reboot. (side note shutdown -h now will not reboot)

Not the answer you're looking for? Browse other questions tagged or ask your own question.