How to Change the SSH Port in Linux Safely

You can change the SSH port in Linux by updating the OpenSSH server configuration, opening the new port in every firewall, testing the configuration, and connecting through a second terminal before closing your current session.

This guide uses port 2222 as an example. Choose an unused TCP port between 1024 and 65535, and replace 2222 in every command if you select another one.

Does changing the SSH port improve security?

Moving SSH away from port 22 can reduce noise from simple automated scans. It does not stop a targeted attacker from finding the new port. Treat it as a small extra layer, not a replacement for SSH key authentication, disabled root login, regular updates, and the steps in our Linux server hardening guide.

Before changing the SSH port

• Keep the current SSH session open throughout the change.
• Confirm that you have sudo or console access.
• Check the host firewall and any cloud firewall or security group.
• Make sure the new port is not already used by another service.
• Back up the OpenSSH configuration.

Check whether port 2222 is already listening:

sudo ss -ltnp | grep ':2222 '

No output normally means that no process is listening on that port. You can also check registered service names with grep -w 2222/tcp /etc/services, but the live ss result matters most.

Step 1: Back up the SSH server configuration

sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

OpenSSH may also read files from /etc/ssh/sshd_config.d/. Check the effective configuration rather than assuming that only one file matters:

sudo sshd -T | grep '^port '

Step 2: Configure the new SSH port

A drop-in file keeps the custom setting separate from the main package file on systems that include sshd_config.d:

printf 'Port 2222\n' | sudo tee /etc/ssh/sshd_config.d/10-custom-port.conf

If your system does not include that directory from /etc/ssh/sshd_config, edit the main file:

sudo nano /etc/ssh/sshd_config

Add or update this directive:

Port 2222

OpenSSH uses the first obtained value for most settings, while multiple Port directives are allowed. Inspect all active files to avoid an unexpected result:

sudo grep -RinE '^[[:space:]]*Port[[:space:]]+' \
  /etc/ssh/sshd_config /etc/ssh/sshd_config.d 2>/dev/null

Step 3: Open the new port in UFW

On Ubuntu or Debian with UFW enabled:

sudo ufw allow 2222/tcp
sudo ufw status numbered

Keep the existing port 22 rule until the new connection has been tested. Our UFW firewall guide explains rule management in more detail.

Step 4: Configure firewalld and SELinux

On RHEL, Rocky Linux, AlmaLinux, or Fedora, allow the port in firewalld:

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-ports

If SELinux is enforcing, label the new port for SSH:

sudo semanage port -a -t ssh_port_t -p tcp 2222

If semanage is missing, install the distribution’s policy utilities package. If the port already has another SELinux label, do not blindly relabel it; choose a different unused port or review the existing service policy.

Verify the SSH port labels:

sudo semanage port -l | grep '^ssh_port_t'

Step 5: Update the cloud firewall

For AWS, Google Cloud, Azure, DigitalOcean, or another hosting provider, allow inbound TCP 2222 in the provider firewall or security group. Restrict the source to your administrator IP or trusted network when possible.

A host firewall rule cannot override a cloud firewall that still blocks the traffic. Do not open the port to the whole internet unless there is a real need.

Step 6: Test the OpenSSH configuration

sudo sshd -t

No output means the syntax check passed. Do not restart SSH if this command reports an error. Fix the named line first.

Confirm the effective port:

sudo sshd -T | grep '^port '

Step 7: Reload or restart SSH

On Ubuntu or Debian:

sudo systemctl restart ssh

On RHEL-based systems:

sudo systemctl restart sshd

Ubuntu releases using systemd socket activation may require a daemon reload when changing port-related settings:

sudo systemctl daemon-reload
sudo systemctl restart ssh.socket

Check which units are active before choosing the command:

systemctl is-active ssh.service ssh.socket sshd.service 2>/dev/null

Step 8: Confirm that SSH is listening

sudo ss -ltnp | grep ':2222 '

You should see a listening SSH process or systemd socket. If nothing appears, inspect the service:

sudo systemctl status ssh --no-pager
sudo journalctl -u ssh -n 50 --no-pager

Use sshd instead of ssh in those commands on distributions where the service is named sshd.

Step 9: Test from a second terminal

Leave the original session open. From your computer, start a new connection:

ssh -p 2222 username@server_ip

If you use a private key:

ssh -i ~/.ssh/id_ed25519 -p 2222 username@server_ip

After login, confirm the server and your sudo access. Only continue when the new session works normally.

Step 10: Remove the old port 22 rule

Once port 2222 has been tested from outside the server, remove the old UFW rule:

sudo ufw delete allow 22/tcp
sudo ufw status numbered

For firewalld:

sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --reload

Also remove port 22 from the cloud firewall. Confirm that no monitoring, backup, deployment, or automation system still expects the old port.

Save the custom port in your SSH client

Edit ~/.ssh/config on your computer:

Host myserver
    HostName 203.0.113.10
    User username
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Then connect with ssh myserver. See our guide to the SSH client configuration file for more examples.

How to recover if the new SSH port fails

Do not close the original session. Check these items in order:

1. Run sudo sshd -t and correct configuration errors.
2. Confirm the effective value with sudo sshd -T | grep '^port '.
3. Check the listener with sudo ss -ltnp.
4. Check UFW or firewalld.
5. Check the cloud firewall or security group.
6. On SELinux systems, confirm the ssh_port_t label.
7. Read the SSH service journal.

To roll back, restore the backup, validate it, and restart the correct service:

sudo cp -a /etc/ssh/sshd_config.backup /etc/ssh/sshd_config
sudo rm -f /etc/ssh/sshd_config.d/10-custom-port.conf
sudo sshd -t
sudo systemctl daemon-reload
sudo systemctl restart ssh

Restore firewall access to port 22 before relying on the rollback connection.

Frequently asked questions

Which SSH port should I use?

Choose an unused TCP port from 1024 through 65535. Avoid ports used by another application and document the choice for your administrators and automation.

Can I use more than one SSH port?

OpenSSH permits multiple Port directives. This can help during a careful migration, but remember to protect and later remove any temporary listener you no longer need.

Why does SSH still listen on port 22?

Another configuration file or a systemd socket may control the listener. Check included files, sshd -T, active systemd units, and the live output of ss -ltnp.

Will changing the port stop brute-force attacks?

It may reduce automated noise, but it will not stop port scanning. Use keys, disable unnecessary privileged login, restrict source addresses, and monitor authentication logs.

Official references

• OpenSSH sshd_config manual
• Ubuntu 24.04 release notes: OpenSSH socket activation
• Red Hat Enterprise Linux security guidance

You now know how to change the SSH port in Linux without unnecessarily risking a lockout. Open the new path first, validate the configuration, keep the existing session open, and remove port 22 only after a successful external test.