How to change the SSH port

Quick answer: Set a new Port value in /etc/ssh/sshd_config, allow that port in your firewall BEFORE restarting SSH, then restart the service and reconnect with ssh -p <port>. Changing the port does not make SSH more secure — it only cuts automated scan noise in your logs.

Overview

Moving SSH off port 22 is security by obscurity: targeted attackers find the new port in seconds with a scan, but the constant background brute-force from bots largely disappears, making logs readable and Fail2ban quieter. Treat it as a comfort measure on top of real hardening — keys, no root login, a firewall — never as a substitute.

Before you start

• A working SSH session you keep open during the whole change.
• A firewall you can edit (how to configure a firewall).
• A port choice between 1024 and 65535 that nothing else uses (e.g. 2222, 22022).

Step-by-step guide

1. Allow the new port in the firewall FIRST:

   ufw allow 2222/tcp                 # Ubuntu/Debian
   firewall-cmd --permanent --add-port=2222/tcp && firewall-cmd --reload   # Alma/Rocky

2. On AlmaLinux/Rocky with SELinux, register the port:

   semanage port -a -t ssh_port_t -p tcp 2222

3. Edit /etc/ssh/sshd_config and set:

   Port 2222

4. Restart SSH: systemctl restart ssh (or sshd).
5. From a NEW terminal test: ssh -p 2222 user@your-server-ip. Only then remove the old port 22 rule from the firewall.

Common issues

• Connection refused after restart: the firewall or SELinux is blocking the new port — recheck steps 1–2 via your still-open session or the KVM Console.
• Forgot the port later: it is in /etc/ssh/sshd_config; log in through the KVM Console to look it up.
• Clients and scripts fail: update saved sessions, ~/.ssh/config, backup jobs and monitoring to the new port.

When to contact support

If you locked yourself out and the KVM Console does not help, open a support ticket. Note: Cloud2Y does not track your custom SSH port — record it somewhere safe.

Frequently asked questions

Does changing the SSH port improve security?

Not against targeted attackers — a port scan finds the new port in seconds. It does reduce automated brute-force noise dramatically, which keeps logs readable and Fail2ban quieter.

Which port number should I choose for SSH?

Pick an unused port between 1024 and 65535, for example 2222 or 22022, and make sure it does not clash with any service you plan to run. Record it somewhere safe — support does not track it.

Why does SSH fail right after I changed the port?

Almost always the firewall was not opened for the new port first, or SELinux on AlmaLinux/Rocky was not updated with semanage. Fix both via your still-open session or the KVM Console.

Related articles

• How to secure SSH access
• How to configure a firewall
• How to install Fail2ban
• How to connect to your server (SSH & RDP)

Need a hand? Contact Cloud2Y support →