How to Change the Default SSH Port on Ubuntu

Secure Shell (SSH) is the backbone of Linux server administration, allowing you to connect to and manage your Ubuntu server remotely. By default, the SSH daemon listens for incoming connections on Port 22.

Because Port 22 is universally known, it is constantly targeted by automated bots and brute-force scripts scanning the internet for vulnerable servers. In this guide, we will walk you through the process of changing the default SSH port to secure your server against these automated attacks.

Why You Should Change the Default SSH Port

Changing your SSH port will not stop a determined, highly skilled attacker from finding your new port via a stealth port scan. However, security is built in layers. This practice, known as “security through obscurity,” is highly effective at reducing the “background noise” of the internet.

By moving your SSH service to a non-standard port, you will immediately see a massive reduction in failed login attempts flooding your server logs, which saves system resources and reduces the risk of a weak password being brute-forced.

Step 1: Choose a New Port Number

Before editing any configuration files, you must select a new port number. Ports range from 0 to 65535, but you should avoid the following:

• Ports 0 to 1023: These are “well-known” ports reserved for standard system services (like Port 80 for HTTP or Port 443 for HTTPS).
• Ports 1024 to 49151: These are “registered” ports often used by specific software applications (like databases or game servers).

For your new SSH port, it is best to choose a random number from the “dynamic” or “private” range: 49152 to 65535. For this guide, we will use Port 55222 as an example.

Step 2: Configure the Ubuntu Firewall (UFW)

Warning: You must complete this step before changing the SSH configuration. If you change the SSH port but forget to open that port in your firewall, you will permanently lock yourself out of your server the next time you disconnect.

1. Log into your Ubuntu server via your current SSH connection.
2. Check the status of UFW (Uncomplicated Firewall):
   sudo ufw status
3. If the firewall is active, allow incoming connections on your newly chosen port:
   sudo ufw allow 55222/tcp
4. Verify that the rule was added successfully:
   sudo ufw status

Step 3: Edit the SSH Configuration File

Now that the firewall is ready, you need to tell the SSH daemon to listen on the new port.

1. Open the SSH daemon configuration file using the nano text editor:
   sudo nano /etc/ssh/sshd_config
2. Use your arrow keys to scroll down until you find the line that says:
   #Port 22
3. The hash symbol (#) means the line is “commented out” and being ignored. Delete the # and change the number to your new port:
   Port 55222
4. Press Ctrl + O, then press Enter to save the file.
5. Press Ctrl + X to exit the nano editor.

Step 4: Restart the SSH Service and Test the Connection

To apply your configuration changes, you must restart the SSH service.

1. Run the following command to restart the daemon:
   sudo systemctl restart ssh
2. Crucial Step: Do not close your current terminal window. If you made a mistake, this active connection is your only way to fix it.
3. Open a new terminal window on your local computer.
4. Attempt to connect to your server using the new port. You must explicitly declare the port using the -p flag:
   ssh -p 55222 username@your_server_ip
5. If the connection is successful and you are prompted for your password, you can safely close the original terminal window.

Finally, return to your server and delete the old firewall rule for Port 22 to complete the security lockdown (sudo ufw delete allow 22/tcp).