How to Change the SSH Port? | phoenixNAP KB (2024)

Introduction

SSH (Secure Shell) is a network protocol that provides a secure way to remotely access a computer or server. Since SSH offers strong password and public key authentication, as well as encrypted data communication between two machines, it is one of the most secure protocols.

However, leaving the default port 22 for SSH creates a security issue that makes the server vulnerable to cyber threats such as brute-force attacks. Therefore, changing the default SSH port is a great way to add extra protection to the server.

In this tutorial, you will learn to change the default SSH port.

Prerequisites

• A system running Linux.
• An account with root privileges.
• Access to the terminal.

Changing the Default SSH Port

Port numbers range from 0 to 65536, but port numbers 0-1023 are reserved for common TCP/IP applications and are called well-known ports. Well-known ports allow client applications to quickly locate the corresponding server application processes when connecting to hosts.

The following table contains the most common privileged services and their associated ports and functions:

Although it is possible to use well-known ports, they might cause a network conflict. Thus, it is safer to choose a port number from 1024-65535 as they are not reserved for any other service.

Follow the steps below to change the default SSH port:

Step 1: Connect to Remote Server

Connect to the remote server via ssh. Open a terminal (Ctrl+Alt+T) and use the following syntax:

ssh username@[ip_address]

For example:

Step 2: Change SSH Configurations

On the remote server, edit the SSH configuration file located in /etc/ssh/sshd_config. Use a text editor of your choice. The default editor on Ubuntu is nano. Run:

sudo nano /etc/ssh/sshd_config

Find the line that reads #Port 22. Either uncomment the line and replace 22 with the desired port number or enter a new line below with the new default SSH port:

Adding a new line allows you to revert to the default settings later by deleting the line.

Save the changes and exit the file.

Alternatively, open the port using iptables. The syntax is:

sudo /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport [port_number] -j ACCEPT

Replace [port_number] with the port you want to open.

Step 3: Update Firewall Rules

Ensure the firewall is not blocking the port you want to use for SSH. Depending on which firewall you are using, update the firewall settings to allow incoming connections to the specified port. The syntax for configuring the ufw firewall is:

sudo ufw allow [port_number]/tcp

For example, we will allow connections to port 1222:

The output states that rules have been updated. Verify that the port is in a listening state by running the ss or netstat command:

ss -tulpn | grep [port_number]

netstat -tulpn | grep [port_number]

For example:

The output shows that the specified port is open.

semanage port -a -t ssh_port_t -p tcp [port_number]

Step 4: Restart SSH

For the configuration changes to take effect, restart the SSH service. Run the following command:

sudo service ssh restart

Step 5: Test the New Port

Test if the new port allows you to connect by establishing a new SSH connection to the server.

The syntax is:

ssh -p [port] username@[ip_address]

For example:

In the example above, the connection was established using the specified port.

Conclusion

This tutorial showed how to change the default SSH port to additionally secure remote connections to your server. A secure connection is important, especially when dealing with sensitive data, so using a port other than the default one is recommended.

For more information, see how SSH works, read the difference between SSH and Telnet, or see the five SSH best practices for securing your system.