Configure SSH Port Linux Security Guide
When it comes to managing servers, one of the first things you do is set up SSH. It is the secure shell protocol that allows you to connect remotely and control your machine as if you were sitting right in front of it. But here is the catch, by default SSH listens on port 22, and everyone knows that. Attackers constantly scan for open port 22 to try brute force logins. That is why changing the ssh port linux configuration is one of the simplest and most effective steps you can take to harden your system. Let us be honest, it is not the only layer of security you should rely on, but it adds friction for potential attackers. In this guide we will go over how to change the SSH port, adjust firewall settings, and test your configuration to make sure everything works without locking yourself out.
Why Change the SSH Port
Here is the thing. Security through obscurity is not a complete solution, but it does reduce noise. By moving SSH away from port 22, you will avoid most automated bots that only target the default port. It will not stop a determined attacker, but it will cut down on brute force attempts and keep your logs cleaner. For many small servers, that already makes a noticeable difference.
Prerequisites Before You Start
Before changing the SSH port, make sure you have:
-
Root or sudo access to the server
-
SSH already installed and working
-
Firewall installed such as UFW or firewalld
It is also wise to keep an existing SSH session open while testing so you do not accidentally lock yourself out.
Step 1 Edit the SSH Configuration File
The SSH configuration file is located at:
sudo nano /etc/ssh/sshd_config
Look for the line that says:
#Port 22
Uncomment it and change 22 to a number of your choice, for example 2222.
Port 2222
Save and exit the file.
Step 2 Adjust the Firewall
Now you need to allow traffic on the new SSH port. If you use UFW, run:
sudo ufw allow 2222/tcp
sudo ufw reload
If you use firewalld:
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload
Do not forget to keep port 22 open until you confirm the new port works, then remove it.
Step 3 Restart the SSH Service
Restart SSH to apply the changes:
sudo systemctl restart sshd
Check the status:
systemctl status sshd
If it is active, you are on the right track.
Step 4 Test the New SSH Port
From another terminal, try connecting to your server using the new port:
ssh -p 2222 user@your-server-ip
If it works, congratulations. Once you verify the connection, go ahead and remove the old port 22 rule from your firewall.
Common Mistakes to Avoid
-
Forgetting to allow the new port in the firewall
-
Closing your only SSH session before testing
-
Choosing a port below 1024 without proper privileges
-
Picking a port already used by another service
Additional Security Tips
Changing the SSH port is a good start, but here are more steps you can take:
-
Disable root login by setting
PermitRootLogin noin sshd_config -
Use SSH keys instead of passwords
-
Set up fail2ban to block repeated failed login attempts
-
Limit which users can log in with
AllowUsersdirective
Final Thoughts on SSH Port Linux Configuration
At first, editing the ssh port linux settings may feel risky because no one wants to lose server access. But when done carefully, it is one of the simplest ways to boost security. Think of it as adding a lock on a side door instead of leaving the front door wide open. It will not stop a skilled intruder, but it will certainly reduce random break in attempts. Combined with other practices like using SSH keys and disabling root login, you will have a much more secure server environment. So go ahead, change that port, test it properly, and enjoy a quieter, safer server.
Sources: Linuxize.com, Ubuntu.com, RedHat.com
Comments
Post a Comment