How to Change the SSH Port on a Linux Server

Changing the SSH port is one of the first hardening steps people read about. It's worth doing, but for the right reason: it doesn't make your server harder to attack — a port scan finds the new port in under a minute — but it silences the constant background noise of opportunistic bots hammering port 22. Your logs become readable again, fail2ban has fewer false alarms, and network bandwidth used by attack traffic drops sharply. This guide walks through the change without the classic lockout.

Before you start

• Working SSH access right now — both as root or via sudo.
• A second terminal you can use to test the new port without losing the first session.
• A port number you'll remember. Pick something between 1024 and 65535 that isn't already used on the system. Common choices: 2222, 22222, or a memorable random number like 48329.
• Knowledge of your firewall: UFW, firewalld, or our cloud-firewall layer.

1Pick a port and check nothing is using it

Avoid ports that already serve traffic on your server. The quickest sanity check is to look at every listening port and pick one not in the list.

# Show every TCP port currently listening, with the owning process
sudo ss -tlnp

# Or grep for a specific candidate port to confirm it's free
sudo ss -tln | grep :2222 || echo "2222 is free"

2Open the new port in your firewall FIRST

This is the step people skip and regret. If you change the SSH config before opening the new port in the firewall, you reload sshd, and your next connection is refused. Always open first, change second.

# Allow the new port BEFORE making any sshd changes
sudo ufw allow 2222/tcp comment "ssh (new port)"
sudo ufw status numbered

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-ports

3Edit the SSH daemon configuration

The cleanest approach is a drop-in file in /etc/ssh/sshd_config.d/ — the main sshd_config stays untouched and your override survives package upgrades cleanly.

sudo nano /etc/ssh/sshd_config.d/10-port.conf

# Listen on the new port. You can list multiple Port lines to listen on
# both old and new at once while you transition.
Port 2222
Port 22

Listing both ports keeps your existing session safe: SSH binds to both during the transition, and you remove the old line after verifying the new one works.

4SELinux: tell it the new port is okay (RHEL family only)

AlmaLinux, Rocky, and other RHEL-family distros run SELinux in enforcing mode. Out of the box, sshd is only allowed to bind to port 22. Skip this step on a RHEL host and sshd will refuse to start on the new port with a permission-denied error.

# Install the policy tool if needed
sudo dnf install -y policycoreutils-python-utils

# Permit sshd to bind to TCP/2222
sudo semanage port -a -t ssh_port_t -p tcp 2222

# Verify
sudo semanage port -l | grep ssh_port_t

Ubuntu and Debian users with AppArmor: no change is needed — the default sshd profile allows any port.

5Validate, reload, and TEST from a second terminal

# 1. Make sure the config has no typos
sudo sshd -t

# 2. Reload (NOT restart — reload keeps your existing session)
sudo systemctl reload ssh        # Debian / Ubuntu
sudo systemctl reload sshd       # AlmaLinux / Rocky

# 3. Confirm sshd is listening on both ports
sudo ss -tlnp | grep sshd

6Remove port 22 once the new port is confirmed working

After verifying you can log in on the new port, edit the drop-in file and remove the Port 22 line. Then close port 22 in the firewall.

# Edit the drop-in and remove "Port 22"
sudo nano /etc/ssh/sshd_config.d/10-port.conf

# Reload SSH
sudo systemctl reload ssh

# Close port 22 in the firewall
sudo ufw delete allow OpenSSH                 # Debian / Ubuntu
sudo ufw delete allow 22/tcp

# Or, on firewalld:
sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --reload

7Tell your laptop the new port

Add the new port to your SSH client config so you never have to type -p 2222 again.

Host prod-web
    HostName your.vps.ip
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Now ssh prod-web hits the new port automatically. Update any deployment scripts, CI runners, and Ansible inventories that reference the old port.

If you do get locked out

Every VPS-SERVER HOST plan includes an out-of-band console in the client area that connects to the hypervisor, not the guest network. If a typo in your sshd_config or a missed firewall rule shuts you out, you can still log in there to fix it.

1. Sign in to your client area.
2. Open My Services → pick the VPS → VNC Console.
3. Log in at the console prompt (using the root password from your welcome email if you didn't change it).
4. Roll back the sshd_config change, re-open port 22 in the firewall, reload sshd.

Frequently asked questions