# How to Change the SSH Port on a Linux Server

Source: https://lyrahosting.com/how-to/how-to-change-the-ssh-port/

1. [Home](https://lyrahosting.com/)
2. [How-to](https://lyrahosting.com/how-to/)
3. How to Change the SSH Port on a Linux Server

How-to

Written by [the LyraHosting technical team](https://lyrahosting.com/about-us/#team) · Reviewed by Erik, certified Linux system administrator (LFCS) · Published 7 Nov 2026 · 5 min read

This guide moves the SSH server on a Linux server from port 22 to another port, on a VPS or a dedicated server. It covers Ubuntu, Debian and Red Hat-family systems such as RHEL, AlmaLinux and Rocky Linux, including the firewall, SELinux and the socket-activated SSH service of Ubuntu 24.04 and later. The examples use port 2222.

Moving SSH off port 22 cuts the noise from automated scanners in your logs. The SSH hardening checklist on the Ubuntu blog lists it for that reason, next to the measures that do the protecting: logging in with SSH keys instead of passwords (`PasswordAuthentication no`), and a firewall that lets SSH in only from addresses you trust. A port change is a useful extra, not a replacement for those.

## Before you start

- Keep your session open. Leave the SSH session you work in open until you have logged in on the new port from a second terminal. If something goes wrong, you can fix it from the session you still have.
- A way back in. On a LyraHosting [Linux VPS](https://lyrahosting.com/offshore-linux-vps/), the VNC or serial console in the control panel reaches the server when SSH doesn't connect. Every LyraHosting [dedicated server](https://lyrahosting.com/offshore-dedicated-servers/) includes IPMI, which works even when the operating system doesn't respond.
- A free port. Check that nothing else listens on the port you want. This command should print nothing: `sudo ss -tlnp | grep ':2222 '`

The commands below use `sudo`; leave it out when you are logged in as root.

## Open the new port in the firewall

Open the port before SSH moves to it, or the firewall blocks your next login.

Ubuntu's default firewall tool is ufw, which is switched off until you enable it. Debian servers may use it too. Check its status:

```
sudo ufw status
```

If the status is active, allow the new port:

```
sudo ufw allow 2222/tcp
```

RHEL, AlmaLinux and Rocky Linux use firewalld. Add the port to the saved configuration, then load it:

```
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload
```

If you manage the firewall another way, for example with your own nftables rules, open TCP port 2222 there.

## Allow the port in SELinux (RHEL, AlmaLinux, Rocky Linux)

SELinux lets sshd listen only on [ports labeled for SSH](https://man7.org/linux/man-pages/man8/semanage-port.8.html). Enforcing mode is the default on Rocky Linux. Check the mode:

```
getenforce
```

If it prints `Enforcing` or `Permissive`, label the new port:

```
sudo semanage port -a -t ssh_port_t -p tcp 2222
```

If `semanage` isn't installed, install it with `sudo dnf install policycoreutils-python-utils`. If the port already has another label, use `-m` instead of `-a` to change it. Check the result with `sudo semanage port -l | grep ssh_port_t`, which should list 2222 and 22. If `getenforce` prints `Disabled`, skip this step.

## Set the new port in the SSH configuration

1. Make a backup copy of the configuration file, then open it:

```
sudo cp /etc/ssh/sshd_config ~/sshd_config.bak
sudo nano /etc/ssh/sshd_config
```

2. Find the line `#Port 22`. Remove the `#` and add a line for the new port below it:

```
Port 22
Port 2222
```

  sshd accepts several `Port` lines, so it will listen on both. You remove port 22 later, once the new port works.
3. Save the file, then test it and see which ports sshd will use:

```
sudo sshd -t
sudo sshd -T | grep -i '^port'
```

`sshd -t` checks the configuration and reports any error; don't go on until it passes. `sshd -T` prints the settings in effect and should list both ports. If 2222 is missing, look in `/etc/ssh/sshd_config.d/`: sshd reads the files there too, and for most settings [the first value it reads wins](https://man7.org/linux/man-pages/man5/sshd_config.5.html). On Ubuntu, those files are read before the rest of `sshd_config`. Set the ports in that file instead.

## Apply the change

How SSH picks up the new port depends on the system.

Ubuntu 24.04 and later start SSH through systemd socket activation: systemd listens on the port and starts sshd when someone connects. A generator builds the socket settings from the `Port` lines in your SSH configuration. So reload systemd and restart the socket, as the note in Ubuntu's own `sshd_config` says:

```
sudo systemctl daemon-reload
sudo systemctl restart ssh.socket
```

Restarting only `ssh.service` leaves SSH on the old port. If you aren't sure whether your server uses the socket, run `systemctl status ssh.socket`. When it shows the socket as active, use the two commands above.

Ubuntu 22.04 and Debian run SSH as the `ssh` service:

```
sudo systemctl restart ssh
```

RHEL, AlmaLinux and Rocky Linux call the service `sshd`:

```
sudo systemctl restart sshd
```

Then check that the server listens on both ports:

```
sudo ss -tlnp | grep -E ':(22|2222) '
```

## Log in on the new port

On your own computer, open a new terminal and connect on port 2222. Leave the first session open:

```
ssh -p 2222 youruser@203.0.113.10
```

If the login fails, use the session you kept open to check the firewall rule, the SELinux label and the output of `ss`. You can also put the backup back with `sudo cp ~/sshd_config.bak /etc/ssh/sshd_config` and apply the change again.

To skip `-p` each time, add the server to `~/.ssh/config` on your computer, then connect with `ssh myserver`:

```
Host myserver
    Hostname 203.0.113.10
    Port 2222
    User youruser
```

Copying files with `scp` needs the port too, with a capital P: `scp -P 2222 file.txt youruser@203.0.113.10:`

## Close port 22

1. Once you can log in on port 2222, remove the `Port 22` line from `sshd_config`.
2. Run `sudo sshd -t` again and apply the change the same way as before.
3. Close port 22 in the firewall, as below.
- ufw: delete the old rule the way it was added, for example `sudo ufw delete allow 22/tcp`. `sudo ufw status numbered` lists the rules. If you delete a rule by its number instead, ufw removes only that line, so a rule that covered IPv4 and IPv6 leaves its other half behind.
- firewalld: run `sudo firewall-cmd --permanent --remove-service=ssh`, then `sudo firewall-cmd --reload`. The `ssh` service is firewalld's rule for port 22.

Finally, log in once more on port 2222 from a new terminal before you close your old session.

In this article

1. [Before you start](https://lyrahosting.com/how-to/how-to-change-the-ssh-port/#before-you-start)
2. [Open the new port in the firewall](https://lyrahosting.com/how-to/how-to-change-the-ssh-port/#open-the-new-port-in-the-firewall)
3. [Allow the port in SELinux (RHEL, AlmaLinux, Rocky Linux)](https://lyrahosting.com/how-to/how-to-change-the-ssh-port/#allow-the-port-in-selinux-rhel-almalinux-rocky-linux)
4. [Set the new port in the SSH configuration](https://lyrahosting.com/how-to/how-to-change-the-ssh-port/#set-the-new-port-in-the-ssh-configuration)
5. [Apply the change](https://lyrahosting.com/how-to/how-to-change-the-ssh-port/#apply-the-change)
6. [Log in on the new port](https://lyrahosting.com/how-to/how-to-change-the-ssh-port/#log-in-on-the-new-port)
7. [Close port 22](https://lyrahosting.com/how-to/how-to-change-the-ssh-port/#close-port-22)

Keep exploring [All how-to guides](https://lyrahosting.com/how-to/) [Talk to our team](https://lyrahosting.com/contact-us/)

## Host it offshore with LyraHosting

KVM virtual servers in the Netherlands with full root access, from €8.99 a month.

[Explore offshore VPS](https://lyrahosting.com/offshore-linux-vps/) [Contact us](https://lyrahosting.com/contact-us/)

Keep reading

## More from the how-to

[View all](https://lyrahosting.com/how-to/)

01 / From the journal

How-to · 7 Nov 2026

### [How to Change the Root Password on a Linux Server](https://lyrahosting.com/how-to/how-to-change-the-root-password/)

Change the root password on Ubuntu, Debian, RHEL, AlmaLinux or Rocky Linux with passwd, pick a strong one, and see why SSH keys are safer.

4 min read [Read article](https://lyrahosting.com/how-to/how-to-change-the-root-password/)

02 / From the journal

How-to · 9 Jun 2022

### [How to Change the IP Address of a Linux Server](https://lyrahosting.com/how-to/how-to-change-ip-address-of-your-server/)

Change a Linux server's IP address on Ubuntu, Debian, RHEL, AlmaLinux or Rocky Linux: test the new address first, then make it permanent.

5 min read [Read article](https://lyrahosting.com/how-to/how-to-change-ip-address-of-your-server/)

03 / From the journal

How-to · 8 Jun 2022

### [How to Set Up an OpenVPN Server on Ubuntu LTS](https://lyrahosting.com/how-to/how-to-setup-an-openvpn-server-on-ubuntu-18-0420-0422-04-lts/)

Set up an OpenVPN server on Ubuntu 24.04 or 22.04 LTS with the openvpn-install script: the firewall, client files, and adding or revoking clients.

9 min read [Read article](https://lyrahosting.com/how-to/how-to-setup-an-openvpn-server-on-ubuntu-18-0420-0422-04-lts/)