Securing remote access to your Linux virtual server is one of the most critical responsibilities of any system administrator or developer. SSH (Secure Shell) is the primary method used to access servers remotely and by default, it listens on port 22.
Because this port is universally known, it is constantly targeted by automated bots attempting brute-force attacks. While changing the SSH port is not a complete security solution, it is a highly effective first step in reducing attack surface and noise.
In this detailed guide, we’ll cover not only how to change the SSH port, but also why it matters, potential pitfalls, and best practices for maintaining a secure server environment.
Understanding the Risk of Default SSH Configuration
Most attackers don’t manually target servers. They use automated scripts that scan IP ranges looking for open port 22. Once found, they attempt:
• Credential stuffing (trying leaked username/password combinations) • Brute-force login attempts • Exploiting weak configurations
Even a small virtual server can receive hundreds or thousands of login attempts per day.
Changing the SSH port helps by:
• Making your server less visible to automated scans • Reducing log spam and system load • Acting as a basic but effective deterrent
Important Considerations Before You Begin
Before making any changes, keep the following in mind:
• Always keep an active SSH session open during configuration • Ensure you have console access (via hosting panel) in case something goes wrong • Use SSH keys if possible, to avoid being locked out • Double-check firewall rules before restarting SSH
Managing a Linux server often comes with questions, especially when it comes to security configurations like SSH. If you ever feel stuck or want real-world insights, you can always ask your questions directly in the community spaces of PlusClouds and connect with other developers and system administrators.
Step 1: Choose a Secure and Unused Port
SSH can run on any port between 1024–65535 (non-privileged ports).
Tips for choosing a port:
• Avoid commonly used ports (e.g., 8080, 3306, 443 alternatives) • Choose something random but memorable • Example ports: 2222, 22022, 48291
To verify a port is unused:
sudo ss -tuln | grep
If no output appears, the port is likely available.
Step 2: Modify the SSH Configuration File
The SSH daemon configuration file is located at: /etc/ssh/sshd_config
Open it with a text editor: sudo nano /etc/ssh/sshd_config
Locate the Port Directive
Find this line: #Port 22
• Uncomment it (remove #) • Replace 22 with your chosen port
Example: Port 2222
Optional: Bind SSH to Specific IP (Advanced)
You can further secure SSH by binding it to a specific IP: ListenAddress 192.168.1.10
This is useful in private or internal networks.
Step 3: Configure the Firewall
This is the most critical step. If you forget it, you may lose access to your server. For UFW (Ubuntu / Debian)
Allow the new port: sudo ufw allow 2222/tcp
Check rules: sudo ufw status
For firewalld (CentOS / RHEL / AlmaLinux)
sudo firewall-cmd --permanent --add-port=2222/tcp sudo firewall-cmd --reload
For iptables (Advanced users) sudo iptables -A INPUT -p tcp --dport 2222 -j ACCEPT
Step 4: Update SELinux (If Enabled)
On systems with SELinux (e.g., CentOS, RHEL), SSH is restricted to predefined ports. To allow a new port: sudo semanage port -a -t ssh_port_t -p tcp 2222
If semanage is not installed: sudo yum install policycoreutils-python-utils
Step 5: Restart the SSH Service
Apply your changes: sudo systemctl restart sshd
Or on some systems: sudo service ssh restart
Step 6: Test the New Port (CRITICAL STEP)
Before closing your current session, open a new terminal and test: ssh -p 2222 username@your_server_ip
If the connection fails:
• Re-check firewall rules • Verify SSH config syntax • Use server console access to fix issues
Step 7: Disable Default Port 22 (Optional but Recommended)
Once the new port works:
UFW: sudo ufw delete allow 22/tcp
firewalld: sudo firewall-cmd --permanent --remove-port=22/tcp sudo firewall-cmd --reload
Verifying the Change
You can confirm SSH is listening on the new port: sudo ss -tuln | grep ssh
Or: sudo netstat -tulnp | grep ssh
Additional Security Best Practices
Changing the port is just one layer. For stronger security:
1. Disable Root Login
PermitRootLogin no
2. Use SSH Key Authentication
Disable passwords entirely: PasswordAuthentication no
3. Install Fail2Ban
Automatically blocks repeated login attempts: sudo apt install fail2ban
4. Limit User Access
AllowUsers yourusername
5. Enable Two-Factor Authentication (2FA)
Adds an extra layer of login protection.
Managing Infrastructure the Smart Way
While manually configuring SSH and firewall rules is essential knowledge, managing multiple servers this way can become complex and time-consuming—especially as your projects grow.
This is where platforms like Plusclouds come in. With scalable cloud infrastructure, automated deployments, and centralized management tools, Plusclouds allows you to:
• Quickly deploy secure virtual servers • Manage firewall and network settings from a single panel • Scale your infrastructure without manual overhead • Focus on development instead of repetitive server configuration
By combining hands-on security practices like SSH hardening with modern cloud management platforms, you can achieve both efficiency and security at scale.
Common Mistakes to Avoid
• Forgetting to open the new port in the firewall • Restarting SSH before verifying configuration • Closing the active session too early • Choosing a port already in use • Ignoring SELinux restrictions
Conclusion
Changing the SSH port is a simple yet impactful step toward improving your server’s security. While it doesn’t eliminate threats entirely, it significantly reduces automated attacks and unnecessary noise.
When combined with:
• SSH key authentication • Proper firewall configuration • Intrusion prevention tools
…it forms part of a strong, layered security strategy.
Whether you’re managing a single VPS or scaling across multiple environments, understanding and applying these practices will help you maintain a secure and reliable infrastructure.
