How to Change the SSH Port (Step-by-Step Security)

Port 22 on every internet-facing server is scanned all day by password-guessing bots. Changing the port removes most of that noise. It is not a firewall on its own, but it cleans up your logs and reduces brute-force attempts.

1. Pick a new port

Choose a port between 1024 and 65535 that no other service uses. Avoid clashing with web (80/443), game or database ports.

2. Edit the configuration

nano /etc/ssh/sshd_config

Find the #Port 22 line, remove the # and set your new port:

Port 2222

3. Open the port in the firewall

Skip this and you will not be able to connect. Ubuntu/Debian (ufw):

ufw allow 2222/tcp

AlmaLinux/CentOS (firewalld):

firewall-cmd --permanent --add-port=2222/tcp
firewall-cmd --reload

On systems with SELinux you also need to allow the port:

semanage port -a -t ssh_port_t -p tcp 2222

4. Restart the service — but keep your session open

systemctl restart sshd

Important: do not close your current SSH session. Open a second terminal and try the new port:

ssh -p 2222 root@SERVER_IP

If it works, close the old session. If it does not, you can revert from the session you kept open. This order is what stops you from locking yourself out.

Changing the port is not enough

• Disable password login: after setting up SSH keys, PasswordAuthentication no makes brute force useless.
• Restrict root login: PermitRootLogin prohibit-password allows key login and blocks passwords.
• Install fail2ban: it temporarily blocks IPs after repeated failures.
• Restrict by IP when possible: with a static IP, open the SSH port only to that address.

Moving to key-based login (recommended order)

1. Generate a key on your own computer: ssh-keygen -t ed25519
2. Copy the public key to the server: ssh-copy-id root@SERVER_IP
3. Open a new terminal and confirm the key login works.
4. Only then set PasswordAuthentication no in sshd_config and restart the service.

The order matters: never disable password login before you have confirmed key login works.

Automatic blocking with fail2ban

apt install fail2ban
systemctl enable --now fail2ban
fail2ban-client status sshd

Even with default settings, fail2ban temporarily blocks an IP after repeated failures. If you moved SSH to a new port, update the port in the jail configuration.

Checklist

• Is the new port open in the firewall?
• Have you confirmed a connection on the new port?
• Does the SSH key work?
• Is password login disabled?
• Is direct root password login restricted?
• Is fail2ban running?

Moving to key-based login (recommended order)

1. Generate a key on your own computer: ssh-keygen -t ed25519
2. Copy the public key to the server: ssh-copy-id root@SERVER_IP
3. Open a new terminal and confirm the key login works.
4. Only then set PasswordAuthentication no in sshd_config and restart the service.

The order matters: never disable password login before you have confirmed key login works.

Automatic blocking with fail2ban

apt install fail2ban
systemctl enable --now fail2ban
fail2ban-client status sshd

Even with default settings, fail2ban temporarily blocks an IP after repeated failures. If you moved SSH to a new port, update the port in the jai