How to Change the SSH Port on a Linux Server

SSH uses port 22 by default. Changing the port cuts down most of the automated login attempts against your server. This guide covers the steps for AlmaLinux, Rocky Linux, Debian and Ubuntu.

Changing the port is not enough on its own as a security measure. We also recommend logging in with an SSH key instead of a password and allowing SSH access only from your own IP addresses.

Before you start

• This guide uses 2222 as the new port; replace it with the number you choose. Do not pick a port used by another service.
• Do not close your open SSH session while making the change. Do not close it until you have tested the new port with a second session; if something goes wrong, you can undo the change from the open session.
• If your server is behind the Verinomi Virtual Firewall, first add a rule for the new port on the firewall page in your client area.

1. Edit the configuration

The port setting is in /etc/ssh/sshd_config. On current distributions this file begins with an Include line that reads the files in /etc/ssh/sshd_config.d/, and settings in that directory take precedence over the main file. We therefore recommend writing the setting to a separate file:

echo "Port 2222" > /etc/ssh/sshd_config.d/port.conf

First check that there is no other Port line:

grep -ri "^Port" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/

Check the configuration for errors; if there is no output, it is fine:

sshd -t

2. AlmaLinux and Rocky Linux

With SELinux enabled, SSH can only listen on ports that SELinux knows as SSH ports. Register the new port with SELinux:

semanage port -a -t ssh_port_t -p tcp 2222

If the semanage command is not found, install this package first:

dnf install policycoreutils-python-utils

If firewalld is enabled, open the new port and make the setting permanent:

firewall-cmd --add-port=2222/tcp
firewall-cmd --runtime-to-permanent

Then restart the SSH service:

systemctl restart sshd

3. Debian

On Debian the service is called ssh:

systemctl restart ssh

If you use ufw or another firewall, open the new port before restarting (for ufw: ufw allow 2222/tcp).

4. Ubuntu

On Ubuntu 22.10 and later, SSH runs with systemd socket activation: the port is listened on by ssh.socket, not by the SSH service. On Ubuntu 24.04 the socket reads the port setting from sshd_config and the sshd_config.d directory through systemd. So after changing the setting, systemd needs to reload it:

ufw allow 2222/tcp
systemctl daemon-reload
systemctl restart ssh.socket

If ufw is disabled, you can skip the first line. Ubuntu 22.04 does not use socket activation; systemctl restart ssh is enough, as on Debian.

5. Connect on the new port

Without closing the old session, open a new session from your own computer:

ssh -p 2222 root@203.0.113.10

If you can connect, you are done. If port 22 is no longer needed, you can close it in the firewall.

Troubleshooting

• I cannot connect on the new port: in the open session, check that the port is listening with ss -tlnp | grep 2222. If it is not, check the configuration and (on AlmaLinux / Rocky) the SELinux step; if it is, check your firewall rules.
• The SSH service does not start: sshd -t shows the faulty line. If you cannot fix it, delete /etc/ssh/sshd_config.d/port.conf and restart the service to go back.
• I cannot reach the server at all: you can open a support ticket from your client area.

The information in this guide is taken from official documentation: sshd_config(5), Ubuntu Server: OpenSSH, Ubuntu: sshd socket activation, Red Hat: Using SELinux, firewall-cmd.