SSH lets you administer a Debian VM without keeping the Proxmox console open. The connection path is:
your computer → network and firewall → Debian VM → OpenSSH server
Work through that chain in order.
1. Install and start OpenSSH in the Debian VM
Open the VM's console in Proxmox and run:
sudo apt update
sudo apt install openssh-server
sudo systemctl enable --now ssh
sudo systemctl status ssh --no-pager
The last command should show active (running).
2. Find the VM's IP address
Inside Debian:
hostname -I
ip -brief address
ip route
Use the address on the same LAN or routed network as your client. An address beginning with 127 is loopback and will not work from another machine.
For a stable server, create a DHCP reservation on your router or configure a static address carefully. A reservation is usually less error-prone.
3. Connect
From Linux, macOS, or a recent Windows terminal:
ssh USERNAME@VM_IP
The first connection shows a host-key fingerprint. Compare it with the fingerprint displayed inside the VM:
sudo ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub
Accept the key only if the fingerprints match.
4. Use an SSH key
On your client:
ssh-keygen -t ed25519 -a 64
ssh-copy-id USERNAME@VM_IP
Test the key in a second terminal before changing password settings:
ssh USERNAME@VM_IP
Once key login works, you can harden /etc/ssh/sshd_config.d/10-hardening.conf:
PermitRootLogin no
PasswordAuthentication no
Validate before reloading:
sudo sshd -t
sudo systemctl reload ssh
Keep the original session open until a new login succeeds. That prevents a typo from locking you out.
Troubleshooting by symptom
Connection timed out
The packets are not reaching SSH. Check the IP, VLAN or bridge, Proxmox firewall, guest firewall, and routing.
ping -c 3 VM_IP
nc -vz VM_IP 22
Connection refused
The VM is reachable, but nothing is listening on port 22:
sudo ss -ltnp | grep ':22'
sudo journalctl -u ssh -b --no-pager
Permission denied
Networking works; authentication failed. Verify the username, home-directory ownership, and key permissions:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
Host key changed
This can be legitimate after rebuilding a VM, but it can also indicate interception. Verify the new fingerprint from the Proxmox console before removing the old entry with ssh-keygen -R VM_IP.
After SSH works, you can manage the VM remotely or follow the Debian disk-resize guide.