How to change the SSH port in Linux

Port 22 is scanned by bots around the clock. Moving SSH to another port does not replace real security (a strong password or, better, SSH keys), but it cuts almost all automated login attempts and keeps your logs clean. This guide works on Debian, Ubuntu, AlmaLinux, Rocky, CentOS and Fedora.

Before you start: keep your current SSH session open until the very end. If something goes wrong, you can fix it from that session, or from Open console on your VPS page, which works even when SSH does not.

1. Pick a port

Choose a number between 1024 and 65535 that nothing else uses, for example 2222 or something less common like 48022. This guide uses 2222; replace it with yours everywhere.

2. Open the new port in the server firewall first

Ubuntu and Debian with UFW (check with sudo ufw status; skip if it says inactive):

sudo ufw allow 2222/tcp

AlmaLinux, Rocky, CentOS, Fedora with firewalld:

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

SELinux (AlmaLinux, Rocky, CentOS, Fedora) also has to allow SSH on the new port:

sudo dnf install -y policycoreutils-python-utils
sudo semanage port -a -t ssh_port_t -p tcp 2222

On CentOS 7 use yum instead of dnf and the package policycoreutils-python.

3. Change the port in the SSH configuration

sudo nano /etc/ssh/sshd_config

Find the line #Port 22 (or Port 22), remove the # and set your port:

Port 2222

Save with Ctrl+O, Enter, and exit with Ctrl+X.

Some images also set the port in a file under /etc/ssh/sshd_config.d/. Check with:

sudo grep -ri '^port' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/

Only your new port should appear.

4. Test the configuration and restart SSH

sudo sshd -t

No output means the file is valid. Then restart SSH with the command for your system:

• Ubuntu 22.10 and newer (including 24.04): SSH is started by a socket, so reload that:

  sudo systemctl daemon-reload
  sudo systemctl restart ssh.socket

• Debian and older Ubuntu:

  sudo systemctl restart ssh

• AlmaLinux, Rocky, CentOS, Fedora:

  sudo systemctl restart sshd

Check that SSH listens on the new port:

sudo ss -tlnp | grep ssh

5. Connect on the new port

Without closing the current session, open a new terminal on your computer:

ssh -p 2222 root@YOUR-SERVER-IP

In PuTTY, WinSCP or FileZilla, change the port field to your new number. Once the new connection works, you can close the old session and remove port 22 from the firewall:

sudo ufw delete allow 22/tcp

or, with firewalld:

sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --reload

Locked out?

Click Open console on your VPS page and log in there. Set Port 22 back in /etc/ssh/sshd_config, restart SSH as in step 4, and try again.

Go further

• Use SSH keys and turn off password logins with PasswordAuthentication no in the same file. That stops password guessing completely.
• Install Fail2ban (sudo apt install fail2ban or sudo dnf install fail2ban) to block IPs that keep failing to log in.