By default, SSH runs on port 22, and this is the very port that bots looking for servers to hack check first. If you move SSH to another port, most of this “noise” simply disappears from the logs.

It is important to understand that changing the port is an extra measure, not a replacement for proper protection. The main thing is SSH key login, and changing the port complements it well.

Do not close your current connection

Do all the steps without closing the session you are connected through. You can close it only after login on the new port works in a separate window.

---

1. Choose a new port

Any free number from 1024 to 65535 will do. In the examples below we use 2222, but it is better to pick something less obvious, for example 48222. Write down the port you chose, because you will need it for every connection.

---

2. Open the new port in the firewall

The commands are run on the server.
On Ubuntu and Debian you can skip this step if your firewall is not turned on.
On AlmaLinux, CentOS and Oracle Linux you need to do it in any case because of SELinux.

# Allow connections to the new SSH port
sudo ufw allow 2222/tcp

# Open the new port in the firewalld firewall
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

# By default, SELinux allows SSH only on port 22.
# Install the semanage utility and add the new port to the list
# of ports allowed for SSH
sudo dnf install -y policycoreutils-python-utils
sudo semanage port -a -t ssh_port_t -p tcp 2222

---

3. Set the new port in the SSH settings

The commands are run on the server.

# Open the file with our SSH settings. If you followed the guide
# on SSH keys, it already exists. If not, the file will be created
sudo nano /etc/ssh/sshd_config.d/00-security.conf

Add a line with the new port to the file.

# SSH now listens on port 2222 instead of 22
Port 2222

To save the file, press Ctrl + O and Enter, and to exit the editor, press Ctrl + X.

# Check the settings for errors. If the command prints nothing,
# everything is fine
sudo sshd -t

---

4. Restart SSH

# In newer Ubuntu releases SSH is started through a systemd socket,
# so first reload the settings and then restart both the socket
# and SSH itself
sudo systemctl daemon-reload
sudo systemctl restart ssh.socket
sudo systemctl restart ssh

# Restart SSH so it starts listening on the new port
sudo systemctl restart ssh

# Restart SSH so it starts listening on the new port
sudo systemctl restart sshd

Now we will make sure SSH is really listening on the new port.

# Port 2222 should appear in the list
sudo ss -tlnp | grep ssh

---

5. Connect on the new port

Run this command on your own computer, in a new terminal window.

# The -p flag sets the port to connect to
ssh -p 2222 admin@SERVER_IP

In Termius, the port is changed in the connection settings, in the Port field.

---

6. Close the old port 22

Once login on the new port works, close port 22 in the firewall.

# Delete the rule for the old SSH port
sudo ufw delete allow 22/tcp

# Check the list of rules
sudo ufw status

# Remove the standard SSH service (port 22) from the open ones
sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --reload

# Check what is open
sudo firewall-cmd --list-all

If you use fail2ban

If you use fail2ban, set the new port in its settings too, otherwise it will block offenders on the wrong port. We showed how to do this in the article on fail2ban.

If you lose access after all

If you lose access after all, open the server with the Console button in the server list in your client area. From there you can delete the Port line from the /etc/ssh/sshd_config.d/00-security.conf file and restart SSH.

---

Our resources

Telegram channel: https://t.me/f3cloud_news
F3 Cloud: https://f3cloud.com