Change SSH port

Description

In this guide, you will learn how to change the default SSH port on your VPS.

Changing the default SSH port can reduce automated scans and unwanted login attempts against port 22. It should be considered an additional security measure, not a replacement for SSH keys, MFA, or Fail2Ban.

We are using the Linux operating system Ubuntu 24.04 and the firewall tool UFW.

What you’ll learn
  • Allow a new SSH port through UFW.
  • Configure a custom port for SSH.
  • Validate the SSH configuration.
  • Disable systemd socket activation.
  • Restart SSH with the new port.
  • Verify that the new SSH port works.
  • Remove the old SSH port from the firewall.
Step by step guide
Bash
# Step 1: Open firewall to allow the new SSH port
sudo ufw allow 23657/tcp comment 'SSH altered'

# Step 2: Configure a new port for SSH
sudo nano /etc/ssh/sshd_config
# Change or add:
#Port 22
# to e. g.:
#Port 23657

# Step 3: Test the SSH configuration for errors (no output means no errors)
sudo sshd -t

# Step 4: Disable systemd socket activation
sudo systemctl disable --now ssh.socket

# Step 5: Restart SSH service to apply changes
sudo systemctl enable --now ssh
sudo systemctl restart ssh
sudo ss -tlnp | grep ssh # should show the new port 23657 

# Step 6: Verify that the new SSH port works using a new terminal session
echo "DO NOT CLOSE THE CURRENT TERMINAL SESSION UNTIL YOU HAVE VERIFIED THAT THE NEW SSH PORT WORKS!"
# ssh -p 23657 user@your_server_ip

# Step 7: Delete the old SSH port from the firewall rules
sudo ufw delete allow 22/tcp
Next steps
Next →