How to Change the SSH Port on a Linux Server

This guide moves the SSH server on a Linux server from port 22 to another port, on a VPS or a dedicated server. It covers Ubuntu, Debian and Red Hat-family systems such as RHEL, AlmaLinux and Rocky Linux, including the firewall, SELinux and the socket-activated SSH service of Ubuntu 24.04 and later. The examples use port 2222.

Moving SSH off port 22 cuts the noise from automated scanners in your logs. The SSH hardening checklist on the Ubuntu blog lists it for that reason, next to the measures that do the protecting: logging in with SSH keys instead of passwords (PasswordAuthentication no), and a firewall that lets SSH in only from addresses you trust. A port change is a useful extra, not a replacement for those.

Before you start

• Keep your session open. Leave the SSH session you work in open until you have logged in on the new port from a second terminal. If something goes wrong, you can fix it from the session you still have.
• A way back in. On a LyraHosting Linux VPS, the VNC or serial console in the control panel reaches the server when SSH doesn't connect. Every LyraHosting dedicated server includes IPMI, which works even when the operating system doesn't respond.
• A free port. Check that nothing else listens on the port you want. This command should print nothing: sudo ss -tlnp | grep ':2222 '

The commands below use sudo; leave it out when you are logged in as root.

Open the new port in the firewall

Open the port before SSH moves to it, or the firewall blocks your next login.

Ubuntu's default firewall tool is ufw, which is switched off until you enable it. Debian servers may use it too. Check its status:

sudo ufw status

If the status is active, allow the new port:

sudo ufw allow 2222/tcp

RHEL, AlmaLinux and Rocky Linux use firewalld. Add the port to the saved configuration, then load it:

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

If you manage the firewall another way, for example with your own nftables rules, open TCP port 2222 there.

Allow the port in SELinux (RHEL, AlmaLinux, Rocky Linux)

SELinux lets sshd listen only on ports labeled for SSH. Enforcing mode is the default on Rocky Linux. Check the mode:

getenforce

If it prints Enforcing or Permissive, label the new port:

sudo semanage port -a -t ssh_port_t -p tcp 2222

If semanage isn't installed, install it with sudo dnf install policycoreutils-python-utils. If the port already has another label, use -m instead of -a to change it. Check the result with sudo semanage port -l | grep ssh_port_t, which should list 2222 and 22. If getenforce prints Disabled, skip this step.

Set the new port in the SSH configuration

1. Make a backup copy of the configuration file, then open it:

   sudo cp /etc/ssh/sshd_config ~/sshd_config.bak
   sudo nano /etc/ssh/sshd_config

2. Find the line #Port 22. Remove the # and add a line for the new port below it:

   Port 22
   Port 2222

   sshd accepts several Port lines, so it will listen on both. You remove port 22 later, once the new port works.
3. Save the file, then test it and see which ports sshd will use:

   sudo sshd -t
   sudo sshd -T | grep -i '^port'

sshd -t checks the configuration and reports any error; don't go on until it passes. sshd -T prints the settings in effect and should list both ports. If 2222 is missing, look in /etc/ssh/sshd_config.d/: sshd reads the files there too, and for most settings the first value it reads wins. On Ubuntu, those files are read before the rest of sshd_config. Set the ports in that file instead.

Apply the change

How SSH picks up the new port depends on the system.

Ubuntu 24.04 and later start SSH through systemd socket activation: systemd listens on the port and starts sshd when someone connects. A generator builds the socket settings from the Port lines in your SSH configuration. So reload systemd and restart the socket, as the note in Ubuntu's own sshd_config says:

sudo systemctl daemon-reload
sudo systemctl restart ssh.socket

Restarting only ssh.service leaves SSH on the old port. If you aren't sure whether your server uses the socket, run systemctl status ssh.socket. When it shows the socket as active, use the two commands above.

Ubuntu 22.04 and Debian run SSH as the ssh service:

sudo systemctl restart ssh

RHEL, AlmaLinux and Rocky Linux call the service sshd:

sudo systemctl restart sshd

Then check that the server listens on both ports:

sudo ss -tlnp | grep -E ':(22|2222) '

Log in on the new port

On your own computer, open a new terminal and connect on port 2222. Leave the first session open:

ssh -p 2222 youruser@203.0.113.10

If the login fails, use the session you kept open to check the firewall rule, the SELinux label and the output of ss. You can also put the backup back with sudo cp ~/sshd_config.bak /etc/ssh/sshd_config and apply the change again.

To skip -p each time, add the server to ~/.ssh/config on your computer, then connect with ssh myserver:

Host myserver
    Hostname 203.0.113.10
    Port 2222
    User youruser

Copying files with scp needs the port too, with a capital P: scp -P 2222 file.txt youruser@203.0.113.10:

Close port 22

1. Once you can log in on port 2222, remove the Port 22 line from sshd_config.
2. Run sudo sshd -t again and apply the change the same way as before.
3. Close port 22 in the firewall, as below.

• ufw: delete the old rule the way it was added, for example sudo ufw delete allow 22/tcp. sudo ufw status numbered lists the rules. If you delete a rule by its number instead, ufw removes only that line, so a rule that covered IPv4 and IPv6 leaves its other half behind.
• firewalld: run sudo firewall-cmd --permanent --remove-service=ssh, then sudo firewall-cmd --reload. The ssh service is firewalld's rule for port 22.

Finally, log in once more on port 2222 from a new terminal before you close your old session.