Change the SSH port

Moving SSH off port 22 makes your logs quieter. It doesn't make a weak setup strong. If you do it, open the new port first and keep 22 working until the new one is tested.

Published 30 October 2026. Assumes OpenSSH with systemd on Debian 12 or later, Ubuntu 22.04, or Ubuntu 24.04 and later (which uses socket activation), with UFW as the firewall.

• Is it worth it?
• The safe order
• Open the firewall first
• Debian and Ubuntu 22.04: sshd_config
• Ubuntu 24.04 and later: ssh.socket
• Test, then close 22

Is it worth it?

Most SSH attacks are bots that try port 22 on every address they can find. Move SSH elsewhere and most of them never reach sshd, so your auth log goes from a constant stream of failed logins to a trickle. That makes real problems easier to spot.

What it doesn't do is stop anyone who looks. A scan of all 65,535 ports finds the new one quickly. If your server allows passwords or root logins, a new port only hides that. Do the real work first: keys, no passwords, and the rest of SSH hardening.

The cost: every client, script, backup job and teammate needs the new port, and some networks only let a few outbound ports through. If that's fine, go ahead. If not, keys-only on 22 plus fail2ban is a perfectly good setup.

The safe order

1. Open the new port in every firewall.
2. Make sshd listen on the new port and 22.
3. Test a login on the new port from a fresh terminal.
4. Only then remove 22 from sshd and the firewall.

The examples use 2222. Pick any free port; check nothing else uses it with sudo ss -tlnp.

Open the firewall first

On the server:

sudo ufw allow 2222/tcp
sudo ufw status

If your provider has its own firewall in the web panel (security groups, cloud firewall), add 2222 there too. That one sits in front of the server, and a missed rule there looks exactly like a broken sshd. See set up UFW safely if UFW isn't set up yet.

Debian and Ubuntu 22.04: sshd_config

Here sshd opens its own listening socket and reads the port from its config. Port may appear more than once, and sshd then listens on each port. Add both to a drop-in:

sudo tee /etc/ssh/sshd_config.d/10-port.conf >/dev/null <<'EOF'
Port 22
Port 2222
EOF
sudo sshd -t && sudo systemctl restart ssh

Your current session survives the restart. Check that sshd now listens on both:

sudo ss -tlnp | grep -E ':(22|2222)\s'

Ubuntu 24.04 and later: ssh.socket

Since Ubuntu 22.10, SSH uses systemd socket activation by default. systemd, not sshd, holds the listening socket, defined in ssh.socket with ListenStream=22. Restarting ssh alone doesn't change which port is open.

On 24.04, a systemd generator (sshd-socket-generator) reads Port and ListenAddress from your sshd config and writes matching ListenStream= lines for the socket. So you still set the port in sshd's config, but you apply it through systemd:

sudo tee /etc/ssh/sshd_config.d/10-port.conf >/dev/null <<'EOF'
Port 22
Port 2222
EOF
sudo sshd -t
sudo systemctl daemon-reload
sudo systemctl restart ssh.socket

daemon-reload reruns the generator; the socket restart makes systemd listen on the new ports. Check what the socket ended up with:

systemctl cat ssh.socket
sudo ss -tlnp | grep -E ':(22|2222)\s'

On 22.10 to 23.10, which are out of support, there is no generator. The socket's own config decides the port: upgrades moved old Port settings into /etc/systemd/system/ssh.socket.d/addresses.conf, and otherwise you set it in a drop-in such as /etc/systemd/system/ssh.socket.d/listen.conf, with an empty ListenStream= line first to clear 22. The same applies on Debian if you switched to ssh.socket yourself.

Test, then close 22

From a new terminal on your Mac:

ssh -p 2222 [email protected]

When that works, so you don't have to type -p each time, add the port to ~/.ssh/config on your Mac:

Host your.server.example
    Port 2222

Then remove 22. Change the drop-in to only Port 2222, apply it the same way as before (restart ssh, or daemon-reload plus restart ssh.socket on 24.04), and check with ss that 22 is gone. Close it in the firewall last:

sudo ufw status numbered
sudo ufw delete allow 22/tcp

If your rule was added as OpenSSH instead of 22/tcp, delete it under that name (sudo ufw delete allow OpenSSH). Also update the provider firewall, any monitoring or backup job that connects over SSH, and the port in your fail2ban jail if you run one.

Sources

1. OpenBSD manual: sshd_config(5) (Port, ListenAddress)
2. Ubuntu openssh package (noble): README.Debian, socket-based activation
3. Ubuntu Discourse: sshd now uses socket-based activation (Ubuntu 22.10 and later)
4. Ubuntu manpage: ufw(8)
5. Ubuntu manpage: ss(8)