Changing the SSH port
Changing the default SSH port (22) reduces exposure to automated scans and basic brute-force attacks, but does not replace proper security measures.
Before making any changes, make sure you have an active SSH session open. Do not close it until you have verified that the new port works. If something goes wrong, you will be locked out of the server.
Choose a port number
Choose a port number above 1024. Ports in the range 49152–65535 are less likely to conflict with other known services. Avoid commonly used alternatives such as 2222 or 22222, as these are frequently targeted by automated scanners. This guide uses 22777 as an example.
Back up the configuration file
Before making any changes, create a backup of the SSH configuration file:
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup
Change the SSH port on Ubuntu and Debian
Starting with Debian 12 and some newer Ubuntu versions (22.04+), SSH may use systemd socket activation by default. In this case, changing the Port directive in sshd_config alone is often not enough.
First, check whether socket activation is active:
systemctl is-active ssh.socket
If the command returns active, configure the SSH socket to use the new port.
Create a systemd override for the SSH socket:
systemctl edit ssh.socket
Add the following content:
[Socket] ListenStream= ListenStream=22777
The empty ListenStream= line clears the default port (22). Without it, SSH may listen on both port 22 and the new port.
For additional reliability, also set the port in the SSH configuration. This helps the systemd generator and preserves the setting across OpenSSH updates:
mkdir -p /etc/ssh/sshd_config.d echo "Port 22777" | tee /etc/ssh/sshd_config.d/10-port.conf
For better compatibility, you can specify the addresses explicitly instead:
[Socket] ListenStream= ListenStream=0.0.0.0:22777 ListenStream=[::]:22777
Save the configuration and apply the changes:
systemctl daemon-reload systemctl restart ssh.socket systemctl restart ssh
Verify that the service is running:
systemctl status ssh.socket
On some newer systems, such as Ubuntu 24.04+, the systemd generator may read the port from sshd_config automatically. In that case, editing Port directly and running systemctl daemon-reload followed by systemctl restart ssh.socket may be sufficient. The override method above works on all versions.
Older Ubuntu and Debian versions
On Ubuntu versions before 22.04 and Debian versions before 12, SSH is not managed by socket activation. Open the SSH configuration file:
nano /etc/ssh/sshd_config
Find the following line:
Port 22
Uncomment it and replace 22 with your chosen port number:
Port 22777
Save the file and validate the configuration:
sshd -t
If the command is not found, use:
/usr/sbin/sshd -t
If the command returns no output, the configuration is valid. Restart the SSH service:
systemctl restart ssh
Disable socket activation
If you prefer to manage SSH through the traditional service instead of the socket, you can disable socket activation:
systemctl disable --now ssh.socket systemctl enable --now ssh
After this, edit sshd_config as described above and restart SSH with:
systemctl restart ssh
Change the SSH port on AlmaLinux, Rocky Linux, and CentOS
Edit the SSH configuration file
Open the SSH configuration file:
nano /etc/ssh/sshd_config
Find the following line:
Port 22
Uncomment it and replace 22 with your chosen port number:
Port 22777
Save the file and validate the configuration:
/usr/sbin/sshd -t
If the command returns no output, the configuration is valid. Restart the SSH service:
systemctl restart sshd
Verify that the service is running:
systemctl status sshd
Allow the port in SELinux
On systems with SELinux enabled, you also need to allow the new port in the SELinux policy. To check which ports are currently allowed for SSH, run:
semanage port -l | grep ssh
Then add or modify the new port:
semanage port -a -t ssh_port_t -p tcp 22777 || semanage port -m -t ssh_port_t -p tcp 22777
If semanage is not installed, install the required package:
dnf install policycoreutils-python-utils
Configure the firewall
Always allow the new port in the firewall before restarting SSH. If you restart SSH first, you may lose access to the server.
UFW
ufw allow 22777/tcp ufw reload ufw status
firewalld
firewall-cmd --permanent --zone=public --add-port=22777/tcp firewall-cmd --reload
iptables
iptables -I INPUT -p tcp --dport 22777 -j ACCEPT iptables-save > /etc/iptables/rules.v4
The iptables-save command saves rules to a file only if iptables-persistent is installed and configured on the system. To install it, run:
apt install -y iptables-persistent
Verify that your distribution uses this file before relying on it for persistence. Note that modern systems may use nftables instead of iptables. If you use nftables, add a rule allowing the new port in your nftables configuration.
Configure Fail2Ban
If Fail2Ban is configured on the server, update the SSH port in its configuration. Open /etc/fail2ban/jail.local or the relevant file under /etc/fail2ban/jail.d/ and set:
port = 22777
After updating the configuration, restart Fail2Ban:
systemctl restart fail2ban
Verify the new port
Check that SSH is listening on the new port:
ss -tlnp | grep :22777
Alternatively, you can list all SSH-related listeners:
ss -tlnp | grep ssh
On older systems, use netstat instead:
netstat -tlnp | grep :22777
You can also check the service status directly.
On Ubuntu and Debian:
systemctl status ssh.socket
On AlmaLinux, Rocky Linux, and CentOS:
systemctl status sshd
Without closing your current SSH session, open a new terminal window and connect using the new port:
ssh root@YOUR_SERVER_IP -p 22777
If the connection is successful, you can close the old session. Then remove port 22 from the firewall rules if it is no longer needed.
For UFW:
ufw delete allow 22/tcp ufw reload
For firewalld:
firewall-cmd --permanent --zone=public --remove-port=22/tcp firewall-cmd --reload
Do not remove port 22 from the firewall before verifying that the new port works. If the new connection fails, use the open SSH session to troubleshoot or revert the changes:
systemctl revert ssh.socket cp /etc/ssh/sshd_config.backup /etc/ssh/sshd_config rm -f /etc/ssh/sshd_config.d/10-port.conf systemctl daemon-reload systemctl restart ssh.socket
If socket activation is disabled, replace the last two commands with:
systemctl restart ssh
Conclusion
Changing the default SSH port from 22 to a custom port can reduce exposure to automated scans and basic brute-force attempts. However, changing the port should be considered an additional security measure rather than a replacement for proper SSH hardening.
Always keep your current SSH session open until you have successfully connected using the new port. Once the new connection has been verified, you can safely close the old session and remove port 22 from the firewall if it is no longer required.
