/etc/ssh/sshd_config, set Port 2222, allow the new port in your firewall, then restart SSH: sudo systemctl daemon-reload && sudo systemctl restart ssh.socket on Ubuntu 24.04, sudo systemctl restart ssh on Debian and Ubuntu 22.04, or sudo systemctl restart sshd on AlmaLinux/Rocky (after semanage allows the port). Keep your current session open until you have logged in on the new port.
Before you start
- Keep your current SSH session open until the very end. It is your way back in.
- Pick a free port between
1024and65535, for example2222. Check nothing else uses it:sudo ss -tlnp | grep ':2222'should print nothing. - On a VPS, know how to open the VNC console in case you lock yourself out.
- Commands use
sudo. As root, leave it out.
Does changing the SSH port make my server secure?
No. It cuts down the number of automated login attempts in your logs, but anyone scanning all ports still finds SSH. Real protection comes from SSH keys, disabled password logins and Fail2ban.How to change the SSH port
1
Set the new port
Open the main SSH config file:Find the line To keep port 22 working while you test, add both lines (
#Port 22, remove the # and change the number:Port 22 and Port 2222). OpenSSH listens on every Port line. Save with Ctrl+O and exit with Ctrl+X.Also check that no file in /etc/ssh/sshd_config.d/ sets a different Port: grep -ri '^port' /etc/ssh/sshd_config.d/.2
Test the configuration
3
Allow the port in the firewall (and SELinux)
- Ubuntu / Debian (UFW)
- AlmaLinux / Rocky (firewalld + SELinux)
sudo ufw status shows Status: inactive), this only stores the rule for later.4
Restart SSH
- Ubuntu 24.04
- Ubuntu 22.04 / Debian
- AlmaLinux / Rocky
Ubuntu 22.10 and later start SSH through a systemd socket (If
ssh.socket), which reads the port from sshd_config. Reload systemd and restart the socket:systemctl is-active ssh.socket says inactive, your server doesn’t use socket activation: run sudo systemctl restart ssh instead.5
Log in on the new port
In a new terminal on your computer:In PuTTY, set Port to
2222.6
Close port 22 (optional)
Only after the new port works, remove One of these may report that the rule doesn’t exist. That is fine.
Port 22 from sshd_config if you added it, restart SSH again, and close the old port:- Ubuntu / Debian (UFW)
- AlmaLinux / Rocky (firewalld)
How to check it worked
On the server, list the ports SSH listens on:systemd because the socket holds the port. What matters is that 2222 appears and 22 doesn’t (once you have removed it).
Frequently asked questions
I changed the port on Ubuntu 24.04 but SSH still listens on 22. Why?
Ubuntu 24.04 usesssh.socket. Restarting ssh.service alone doesn’t move the port. Run sudo systemctl daemon-reload and then sudo systemctl restart ssh.socket (Ubuntu bug 2069041).
SSH won’t start on AlmaLinux after the change. What’s wrong?
Most often SELinux blocks the port. The journal (sudo journalctl -u sshd -n 20) shows error: Bind to port 2222 ... failed: Permission denied. Run the semanage port -a -t ssh_port_t -p tcp 2222 command and restart sshd.
I’m locked out after changing the port. How do I get back in?
On a VPS, log in through the VNC console, then fix the firewall rule or setPort 22 again. See locked out after a firewall change.
Related guides
VPS and dedicated server guides
Every guide in this section.
Set up UFW
Firewall rules on Ubuntu and Debian.
Set up firewalld
Firewall rules on AlmaLinux and Rocky.
SSH config shortcuts
Save the port so you don’t type -p.
Disable password login
The change that actually stops brute force.
Checked against the official OpenSSH sshd_config manual, Ubuntu’s socket activation notes and Red Hat’s SELinux guide on 4 November 2026;
sshd -t, multiple Port lines and the UFW rule (dry run) were tested on Ubuntu 24.04 LTS. Service restarts and the AlmaLinux steps were not tested.Need Extra Help?
If you encounter any issues, our support team is ready to assist:- Live Chat: Quick assistance via our website.
- Support Ticket: Open a Ticket
- Discord: Join our Community
- Email: support@freakhosting.com
Last Updated: November 2026