How to Set up OpenSSH Password Authentication in Ubuntu 26.04

What you need before you start

• An Ubuntu machine (physical, virtual or cloud) with a user account that can run sudo (administrator-level commands).
• The Ubuntu machine’s IP address. This article uses 192.0.2.10 as an example.
• A Windows 11 PC on the same network, or with a route to the server.

Password authentication means the server checks who you are by asking for the account password. It works immediately, but it is weaker than SSH keys. Read the security section before you expose a server to the internet.

Install and start the OpenSSH server on Ubuntu

Do this on the Ubuntu machine. Every step that uses sudo requires an account with administrator rights.

Install the package

This installs the SSH server and confirms it is running.

1. Open a terminal on the Ubuntu machine.
2. Refresh the package list (administrator rights required):

   🐧Bash / Shell

   Copy

   sudo apt update

3. Install the 💿 server (administrator rights required):

   🐧Bash / Shell

   Copy

   sudo apt install openssh-server

   Enter your password when prompted. Confirm with Y if asked.
4. Check that the service is running:

   💻Code

   Copy

   systemctl status ssh

   The output should show active (running), or active (listening) on releases that start SSH on demand. Press Q to leave the status view.

Find the server’s IP address

You need this address to connect from Windows. Run this command on the Ubuntu machine:

ip -br address

Find the address next to your active network adapter, such as 192.0.2.10/24. Use only the number before the slash as the IP address. The part after the slash describes the size of the network, so you can ignore it when you connect from Windows.

Allow SSH through the firewall

Skip this section if UFW (Ubuntu's firewall tool) is not enabled. Check with sudo ufw status.

1. Allow SSH traffic, which uses TCP port 22 (administrator rights required):

   🐧Bash / Shell

   Copy

   sudo ufw allow ssh

2. Confirm the rule:

   🐧Bash / Shell

   Copy

   sudo ufw status

   The list should show 22/tcp as ALLOW.

Confirm that password authentication is on

Ubuntu normally allows passwords by default, but cloud images and hardened setups often switch them off. This check shows the setting the server is actually using.

Run this on the Ubuntu machine:

sudo sshd -T | grep -i passwordauthentication

passwordauthentication yes means passwords are allowed, so you can move on to connecting. passwordauthentication no means you need the next section.

Turn password authentication on

OpenSSH uses the first value it finds for a setting. Ubuntu reads the files in /etc/ssh/sshd_config.d/ in alphabetical order, so a low-numbered file takes priority over one such as 50-cloud-init.conf. Leave the main file alone when a drop-in file does the job. A drop-in file (a small separate config file that adds to or overrides the main one) is easier to undo.

1. Create a new configuration file (administrator rights required):

   🐧Bash / Shell

   Copy

   sudo nano /etc/ssh/sshd_config.d/01-password-auth.conf

2. Type this single line:

   💻Code

   Copy

   PasswordAuthentication yes

3. Press Ctrl+O, then Enter to save. Press Ctrl+X to exit.
4. Test the configuration for mistakes:

   🐧Bash / Shell

   Copy

   sudo sshd -t

   No output means the syntax is valid.
5. Restart the SSH service so it reads the change (administrator rights required):

   🐧Bash / Shell

   Copy

   sudo systemctl restart ssh

6. Run the check from the previous section again. It should now report passwordauthentication yes.

If another file or the main sshd_config still overrides your setting, find the conflicting line with sudo grep -ri passwordauthentication /etc/ssh/.

Connect from 🪟 Windows 11

Windows 11 includes the OpenSSH Client, so you need no extra software. You do not need administrator rights on Windows for the connection itself.

Check that the OpenSSH Client is installed

1. Right-click Start and select Terminal.
2. Type ssh -V and press Enter. A version number means the client is ready.
3. If Windows reports that the command is not recognized, open Settings › System › Optional features

   

4. Select View features next to Add an optional feature.
5. Search for OpenSSH Client, tick it, then select Next and Add. This step needs administrator rights.

Log in to the Ubuntu server

1. In Terminal, run the command with your Ubuntu username and the server's address:

   💻Code

   Copy

   ssh USERNAME@192.0.2.10

2. Type yes when Windows asks whether you trust the host's fingerprint (a unique ID for the server). This prompt appears only on the first connection.
3. Type the account password and press Enter. No characters appear and the cursor does not move while you type. This is normal.
4. Look for the Ubuntu shell prompt, such as USERNAME@COMPUTER-NAME:~$. It means you are logged in.
5. Type exit to close the session.

If the server uses a port other than 22, add -p and the number, for example ssh -p 2222 USERNAME@192.0.2.10.

Fix common connection problems

Connection timed out or refused

1. In Terminal on Windows, test whether port 22 is reachable:

   💻Code

   Copy

   Test-NetConnection 192.0.2.10 -Port 22

2. Check the TcpTestSucceeded line. False means something blocks the path: a wrong IP address, a UFW rule, a router, or an SSH service that is not running.
3. On Ubuntu, confirm the service with systemctl status ssh and the firewall with sudo ufw status.

Permission denied

• Retype the password carefully. Keyboard layout differences between Windows and the Ubuntu account can change special characters.
• Check that the username is the Ubuntu account name, not your Windows name.
• On Ubuntu, read the log for the exact reason:
  🐧Bash / Shell

  Copy

  sudo journalctl -u ssh -n 50

Host key warning after reinstalling the server

Continue only if you know why it changed.

1. Remove the old entry:

   💻Code

   Copy

   ssh-keygen -R 192.0.2.10

2. Connect again and accept the new fingerprint.

Reduce the risk of password logins

Automated bots scan the internet for open SSH ports and try to guess passwords all day and night. If the server is reachable from outside your home or office network, take these precautions:

• Use long, unique passwords on every account that can log in over SSH.
• Block direct root logins by adding PermitRootLogin no to a file in /etc/ssh/sshd_config.d/, then run sudo sshd -t and sudo systemctl restart ssh. This needs administrator rights.
• Keep a second session open while you change SSH settings. If you make a mistake, you can still fix it without being locked out.
• Limit who can reach port 22 with a firewall rule or your router settings.
• Switch to SSH keys when you can, then turn passwords off.

What to do next

Confirm that key-based login works first, or you lock yourself out. Setting up an SSH key pair from Windows 11 with ssh-keygen is the natural next task, and it lets you retire password logins for good.