If you spin up a brand new, clean Ubuntu or Debian server on a major cloud provider (like DigitalOcean or AWS) and connect it to the public internet, you are in immediate danger. Within exactly 15 minutes of booting up, your server’s security logs will show hundreds of automated bots actively trying to guess your root password.
This happens because every single hacker script in the world knows that the SSH service (the remote control terminal) listens on Port 22 by default. They simply scan the entire internet for IP addresses with Port 22 open, and then launch massive brute-force dictionary attacks against them.
The easiest, most effective way to eliminate 99% of this automated background noise is “security through obscurity.” By simply moving your SSH service from Port 22 to a massive, random number (like Port 54932), the automated bots will completely ignore your server, believing it has no terminal installed.
Step 1: Choose a New Port Number
You cannot pick just any number. Ports 1 through 1024 are strictly reserved for official system services (like port 80 for HTTP or 443 for HTTPS). You must choose a random port number between 1024 and 65535. For this example, we will use 54932.
Step 2: Modify the SSH Daemon Configuration
You must edit the core configuration file for the SSH service.
- Log into your server via SSH (currently on Port 22).
- Open the configuration file using a text editor like nano:
sudo nano /etc/ssh/sshd_config - Use the arrow keys to scroll down until you find the line that says:
#Port 22 - Delete the
#symbol (which un-comments the line, making it active). - Change the number 22 to your new custom port:
Port 54932 - Press Ctrl+O, then Enter to save the file.
- Press Ctrl+X to exit the nano editor.
Step 3: Update Your Firewall (CRITICAL)
If you restart the SSH service right now, your server’s firewall will instantly block the new port, permanently locking you out of your own machine. You must open the new port first.
- If you are using UFW (Uncomplicated Firewall, standard on Ubuntu):
sudo ufw allow 54932/tcp - (Optional) You can now close the old port to clean up the rules:
sudo ufw delete allow 22/tcp
Step 4: Restart the Service and Reconnect
- Command the SSH daemon to restart and read the new configuration file:
sudo systemctl restart sshd
Do not close your current terminal window yet. If you made a mistake, closing this window will lock you out forever.
Open a brand new Terminal window on your local computer, and attempt to connect using the new custom port flag (-p):
ssh username@your_server_ip -p 54932
If the connection succeeds and you see the bash prompt, congratulations! You have successfully moved your SSH tunnel. You can safely close the old terminal window. If you run a tail -f /var/log/auth.log tomorrow, you will notice your server is completely silent, free from the endless barrage of brute-force dictionary attacks.