How to Change the Default SSH Port on Linux

You can do that by changing the Port directive in /etc/ssh/sshd_config to the desired value and restarting the service. This article explains how to do that, configure your firewall to not lock yourself out, and connect via SSH to the new port.

What port does SSH use by default?

Port 22. The default value is defined by the Port directive in the sshd_config file, which is set to 22.

According to the documentation, "the Port directive specifies the port number that sshd(8) listens on" and "the default is 22". It is the reason why the first thing that automated scanners do when checking a server is scanning port 22 — changing this port does not increase SSH security in itself but makes you invisible for such automated sweeps.

How do I change the SSH port on Linux?

By editing /etc/ssh/sshd_config, changing the Port directive to your desired port number, and restarting the SSH service. Pick a port above 1024 to stay outside the range for well-known services.

$ sudo nano /etc/ssh/sshd_config
# Port 22
Port 2222

$ sudo sshd -t
$ sudo systemctl restart ssh

Before restarting, run sudo sshd -t, the same as you would do for any sshd_config change — it prevents a typo in the port number from breaking your access to the server.

Do I need to update my firewall after changing the port?

Yes, and do it before disconnecting. First, open the new port and only then close the old one to prevent yourself from locking yourself out between the two steps.

$ sudo ufw allow 2222/tcp
$ sudo systemctl restart ssh
$ ssh -p 2222 user@host          # make sure it works first
$ sudo ufw delete allow 22/tcp   # do it only after making sure

The order of commands is more important than the individual commands themselves — open the port first, test the connection in a second terminal window while the current SSH session is still alive, and only delete the old rule once you've made sure that the new port works.

How do I connect once the port has changed?

Use -p option with the new port number: ssh -p 2222 user@host. Without it, ssh assumes that the port is 22 and fails due to timeout.

If you are going to connect to the same machine often, add a Host block in ~/.ssh/config file with the new port included — this way, you'll have to type a short ssh host instead of the -p flag every time:

Host myserver
    HostName host
    Port 2222

Does changing the SSH port actually improve security?

It reduces the number of automated scans on port 22, but it is not a substitution of key-based authentication and password login disabling. It is better to treat changing the port as a noise reduction rather than a security feature.

Changing the port does not improve security — the real security measures are disabling password authentication and root login in the sshd_config file. Changing the port just reduces the number of useless messages in your auth logs about attempts to brute-force SSH password on port 22. Our VPS plans and Bare Metal servers provide you with full access to sshd_config and the firewall to change the SSH port and perform the needed auth hardening.