WardtermSSH client
EN
Download

How to change the SSH port without locking yourself out

Keep your session open. Open the new port in the firewall, add Port 22 and Port 2222 to the sshd configuration, and apply it. On recent Ubuntu that means sudo systemctl daemon-reload and sudo systemctl restart ssh.socket. Test ssh -p 2222 user@server in a new terminal, then remove port 22. It reduces log noise, not real attacks.

Updated . Full procedure run on Ubuntu 24.04 and 26.04 (socket and ufw), Debian 13 (service), and Rocky Linux 9 (firewalld), all in throwaway containers with systemd.

What it does and does not protect from

A new port stops the automated scans that only try port 22, so your logs get much quieter. That is the whole benefit. A scan of all ports still finds SSH, because the server announces itself as soon as something connects. Weak passwords stay weak on any port. Do the things that really matter first: turn off password login and review the sshd configuration.

It has small costs as well: every tool now needs the port, and your known_hosts treats the new port as a new entry, so you confirm the fingerprint again.

Pick a port that nothing else uses. Ports below 1024 can only be opened by root, which is a small advantage if sshd is ever down.

1. Keep a way back

Keep your current session open until the last step. An existing session normally survives a restart of sshd, so it is your way back. If you can reach a console from your provider, find it before you begin.

2. Open the new port first

With ufw:

sudo ufw allow 2222/tcp

With firewalld, on RHEL, Rocky, AlmaLinux and Fedora:

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

A cloud server usually also has a firewall or security group in the provider's panel. Open the port there too. That one is the most common reason for a timeout after this change.

SELinux

On RHEL-family systems with SELinux enforcing, sshd cannot use a new port until you label it. The default sshd_config on those systems says so as well. Check, then add the label:

getenforce
sudo semanage port -a -t ssh_port_t -p tcp 2222
sudo semanage port -l | grep ssh

If getenforce says Disabled, skip this. In that state semanage fails with SELinux policy is not managed or store cannot be accessed, which is harmless. If semanage is missing, it comes in the package policycoreutils-python-utils.

3. Add the new port beside the old one

Do not replace the old port yet. Create a small file, which leaves the main configuration untouched:

printf 'Port 22\nPort 2222\n' | sudo tee /etc/ssh/sshd_config.d/10-port.conf
sudo sshd -t

If sshd -t prints nothing, the syntax is valid. Older systems without that folder need the same two lines in /etc/ssh/sshd_config.

4. Apply it: this depends on the system

First ask which case you are in:

systemctl is-active ssh.socket

It says active (Ubuntu 24.04 and 26.04 by default). The socket holds the port and is generated from your configuration, so restarting the service is not enough:

sudo systemctl daemon-reload
sudo systemctl restart ssh.socket

This is the usual trap. In our test, sudo systemctl restart ssh alone left the old ports listening and raised no error.

It says inactive (Debian, Ubuntu 22.04):

sudo systemctl restart ssh

RHEL family, where the service has another name:

sudo systemctl restart sshd

Ubuntu 22.10 to 23.10 used the socket differently and are out of support. There, check systemctl cat ssh.socket before relying on these steps.

Now check both ports are listening:

ss -tln | grep -E ':(22|2222)\b'

5. Test from a new terminal

Leave the old session open and, from your own machine, run:

ssh -p 2222 user@server

A timeout means a firewall is still in the way. Connection refused means nothing is listening, or SELinux stopped sshd from binding. Fix it now, while port 22 still works.

6. Close port 22

Only after the test works:

echo 'Port 2222' | sudo tee /etc/ssh/sshd_config.d/10-port.conf
sudo sshd -t

If the main /etc/ssh/sshd_config has an uncommented Port 22 line, comment it out too, or sshd keeps listening there. Apply it as in step 4, confirm with sudo sshd -T | grep -i ^port, then remove the old firewall rule, using whichever applies:

sudo ufw delete allow 22/tcp
sudo ufw delete allow OpenSSH
sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --reload

Test once more in a new terminal, and only then close the old session.

Update your client

Save the port so you can stop typing it:

Host server
    HostName 203.0.113.10
    Port 2222
    User user

For more settings you can keep per host, see these ssh config file examples.

Note that scp uses a capital -P for the port, unlike ssh. If you run fail2ban, tell it the new port as well. See fail2ban for SSH.

Questions

Is changing the SSH port worth it?

It cuts the noise from bots that only try port 22. It does not stop a targeted attack: key-only login and an updated server matter more.

Why does the new SSH port not work on Ubuntu 24.04?

Ubuntu 24.04 starts sshd through ssh.socket. After changing Port, run sudo systemctl daemon-reload and sudo systemctl restart ssh.socket, then check with ss -tln.

How do I connect to SSH on another port?

Use ssh -p 2222 user@server, or put Port 2222 under the server's Host entry in ~/.ssh/config. scp takes the port with a capital -P.

Sources

More in Securing a server

All guides