SSH listens on port 22 by default, and automated bots try to log in on port 22 all day long. Moving SSH to another port does not make a server secure on its own, but it cuts that background noise and keeps your logs readable. The risk is locking yourself out, so this guide does the steps in a safe order: open the new port first, switch, test, and only then close the old one.
Quick answer
- Pick a port between 1024 and 65535 that nothing else uses, for example
2288. - Allow it in your firewall, and on AlmaLinux/Rocky Linux also in SELinux.
- Set
Port 2288in/etc/ssh/sshd_config, check the file withsshd -t, and restart SSH. - Keep your current session open, and log in again from a new window on the new port.
- Once that works, remove port 22 from the firewall.
What you need: root access, and ideally a way into the server that does not use SSH (your provider's web console), just in case.
1. Choose a port
Use a number between 1024 and 65535. Ports below 1024 are reserved for standard services. Check that nothing already uses your choice:
ss -tlnp | grep ':2288 '
No output means the port is free. This guide uses 2288 as the example; replace it with your own number throughout.
2. Open the new port in the firewall
Do this before changing SSH, or the firewall will block you when SSH moves.
firewalld (AlmaLinux, Rocky Linux):
firewall-cmd --permanent --add-port=2288/tcp
firewall-cmd --reload
ufw (Ubuntu, Debian):
ufw allow 2288/tcp
CSF (common on cPanel servers): add 2288 to both TCP_IN and TCP6_IN in /etc/csf/csf.conf, keep 22 there for now, then run csf -r. See How to Install CSF Firewall.
Also check any firewall outside the server, such as your cloud provider's security group.
3. Allow the port in SELinux (AlmaLinux, Rocky Linux)
On systems with SELinux enforcing, SSH is only allowed on ports labelled for SSH. Add yours: semanage-port manual
semanage port -a -t ssh_port_t -p tcp 2288
If semanage is not found, install it with dnf install policycoreutils-python-utils. Check with getenforce: if it prints Disabled, you can skip this step. Debian and Ubuntu do not use SELinux by default.
4. Change the SSH port
Open the SSH server's configuration file:
vi /etc/ssh/sshd_config
Find the line #Port 22, remove the #, and change the number:
Port 2288
On newer systems, settings may also live in files under /etc/ssh/sshd_config.d/. Port is allowed more than once, and SSH listens on every Port line it finds. sshd_config manual Check that only your new port is set:
grep -ri '^port' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/
Then test the configuration. No output means it is valid:
sshd -t
5. Restart SSH
On AlmaLinux and Rocky Linux:
systemctl restart sshd
On Debian, and Ubuntu 22.04 or older:
systemctl restart ssh
On Ubuntu 22.10 and newer, SSH is started by a systemd socket, which reads the port when systemd reloads:
systemctl daemon-reload
systemctl restart ssh.socket
Restarting does not disconnect your current session.
6. Check and test
Confirm SSH is listening on the new port:
ss -tlnp | grep ssh
LISTEN 0 128 0.0.0.0:2288 0.0.0.0:* users:(("sshd",pid=10585,fd=3))
LISTEN 0 128 [::]:2288 [::]:* users:(("sshd",pid=10585,fd=4))
Now, without closing your current session, open a new terminal and connect on the new port:
ssh -p 2288 root@your-server-ip
If it fails, use the session that is still open to fix the firewall, SELinux or config, or change the port back.
7. Close port 22
Only after the new port works, remove the old one: firewall-cmd --permanent --remove-service=ssh then firewall-cmd --reload (firewalld), ufw delete allow 22/tcp (ufw), or remove 22 from TCP_IN and TCP6_IN and run csf -r (CSF).
From now on, connect with ssh -p 2288, and update the port in your SSH client, SFTP program and any backup or monitoring tools that use SSH.
Changing the port is not enough on its own
A different port hides SSH from the laziest bots, but a port scan finds it in seconds. For real protection, also use SSH keys instead of passwords, and a firewall that blocks repeated failed logins, such as CSF's login failure daemon.