> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Change the SSH Port on Linux

> Change the SSH port on Linux: set Port 2222 in sshd_config, allow it in UFW or firewalld (and SELinux), restart SSH, then test the new port before closing port 22.

To change the SSH port on Linux, edit `/etc/ssh/sshd_config`, set `Port 2222`, allow the new port in your firewall, then restart SSH: `sudo systemctl daemon-reload && sudo systemctl restart ssh.socket` on Ubuntu 24.04, `sudo systemctl restart ssh` on Debian and Ubuntu 22.04, or `sudo systemctl restart sshd` on AlmaLinux/Rocky (after `semanage` allows the port). Keep your current session open until you have logged in on the new port.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Intermediate | 10 to 15 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | Root or sudo access, a second terminal |

## Before you start

* Keep your current SSH session open until the very end. It is your way back in.
* Pick a free port between `1024` and `65535`, for example `2222`. Check nothing else uses it: `sudo ss -tlnp | grep ':2222'` should print nothing.
* On a VPS, know how to open the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) in case you lock yourself out.
* Commands use `sudo`. As root, leave it out.

> [!WARNING]
>
> Always open the new port in the firewall **before** you restart SSH, and only close port 22 after you have logged in on the new port. A wrong order locks you out.

## Does changing the SSH port make my server secure?

No. It cuts down the number of automated login attempts in your logs, but anyone scanning all ports still finds SSH. Real protection comes from [SSH keys](https://help.freakhosting.com/portals/other/how-to-create-and-use-ssh-keys.md), [disabled password logins](https://help.freakhosting.com/portals/other/how-to-disable-password-login-for-ssh.md) and [Fail2ban](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md).

## How to change the SSH port

**1. Set the new port**

Open the main SSH config file:

```bash theme={null}
sudo nano /etc/ssh/sshd_config
```

Find the line `#Port 22`, remove the `#` and change the number:

```ini theme={null}
Port 2222
```

To keep port 22 working while you test, add both lines (`Port 22` and `Port 2222`). OpenSSH listens on every `Port` line. Save with **Ctrl+O** and exit with **Ctrl+X**.

Also check that no file in `/etc/ssh/sshd_config.d/` sets a different `Port`: `grep -ri '^port' /etc/ssh/sshd_config.d/`.

**2. Test the configuration**

```bash theme={null}
sudo sshd -t
```

No output means the file is valid.

**3. Allow the port in the firewall (and SELinux)**

> [tab] Ubuntu / Debian (UFW)
>
> ```bash theme={null}
> sudo ufw allow 2222/tcp
> ```
>
> If UFW is inactive (`sudo ufw status` shows `Status: inactive`), this only stores the rule for later.

> [tab] AlmaLinux / Rocky (firewalld + SELinux)
>
> SELinux only lets SSH listen on ports labelled `ssh_port_t`. Add the new port, then open it in firewalld:
>
> ```bash theme={null}
> sudo dnf install -y policycoreutils-python-utils
> sudo semanage port -a -t ssh_port_t -p tcp 2222
> sudo firewall-cmd --permanent --add-port=2222/tcp
> sudo firewall-cmd --reload
> ```
>
> Check the SELinux label with `sudo semanage port -l | grep ssh_port_t`.

**4. Restart SSH**

> [tab] Ubuntu 24.04
>
> Ubuntu 22.10 and later start SSH through a systemd socket (`ssh.socket`), which reads the port from `sshd_config`. Reload systemd and restart the socket:
>
> ```bash theme={null}
> sudo systemctl daemon-reload
> sudo systemctl restart ssh.socket
> ```
>
> If `systemctl is-active ssh.socket` says `inactive`, your server doesn't use socket activation: run `sudo systemctl restart ssh` instead.

> [tab] Ubuntu 22.04 / Debian
>
> ```bash theme={null}
> sudo systemctl restart ssh
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo systemctl restart sshd
> ```

**5. Log in on the new port**

In a **new** terminal on your computer:

```bash theme={null}
ssh -p 2222 alex@203.0.113.10
```

In PuTTY, set **Port** to `2222`.

**6. Close port 22 (optional)**

Only after the new port works, remove `Port 22` from `sshd_config` if you added it, restart SSH again, and close the old port:

> [tab] Ubuntu / Debian (UFW)
>
> ```bash theme={null}
> sudo ufw delete allow 22/tcp
> sudo ufw delete allow OpenSSH
> ```
>
> One of these may report that the rule doesn't exist. That is fine.

> [tab] AlmaLinux / Rocky (firewalld)
>
> ```bash theme={null}
> sudo firewall-cmd --permanent --remove-service=ssh
> sudo firewall-cmd --reload
> ```

## How to check it worked

On the server, list the ports SSH listens on:

```bash theme={null}
sudo ss -tlnp | grep -E 'sshd|systemd'
```

```text theme={null}
LISTEN 0  4096   0.0.0.0:2222   0.0.0.0:*   users:(("sshd",pid=1234,fd=3))
LISTEN 0  4096      [::]:2222      [::]:*   users:(("sshd",pid=1234,fd=4))
```

On Ubuntu 24.04 the process may show as `systemd` because the socket holds the port. What matters is that `2222` appears and `22` doesn't (once you have removed it).

## Frequently asked questions

### I changed the port on Ubuntu 24.04 but SSH still listens on 22. Why?

Ubuntu 24.04 uses `ssh.socket`. Restarting `ssh.service` alone doesn't move the port. Run `sudo systemctl daemon-reload` and then `sudo systemctl restart ssh.socket` ([Ubuntu bug 2069041](https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2069041)).

### SSH won't start on AlmaLinux after the change. What's wrong?

Most often SELinux blocks the port. The journal (`sudo journalctl -u sshd -n 20`) shows `error: Bind to port 2222 ... failed: Permission denied`. Run the `semanage port -a -t ssh_port_t -p tcp 2222` command and restart `sshd`.

### I'm locked out after changing the port. How do I get back in?

On a VPS, log in through the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md), then fix the firewall rule or set `Port 22` again. See [locked out after a firewall change](https://help.freakhosting.com/portals/other/how-to-fix-locked-out-after-firewall-change.md).

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Set up UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md)
>
> Firewall rules on Ubuntu and Debian.

> [card] [Set up firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md)
>
> Firewall rules on AlmaLinux and Rocky.

> [card] [SSH config shortcuts](https://help.freakhosting.com/portals/other/how-to-use-ssh-config-file-shortcuts.md)
>
> Save the port so you don't type -p.

> [card] [Disable password login](https://help.freakhosting.com/portals/other/how-to-disable-password-login-for-ssh.md)
>
> The change that actually stops brute force.

***

> [!NOTE]
>
> **Checked against the official [OpenSSH sshd\_config manual](https://man.openbsd.org/sshd_config), [Ubuntu's socket activation notes](https://discourse.ubuntu.com/t/sshd-now-uses-socket-based-activation-ubuntu-22-10-and-later/30189) and [Red Hat's SELinux guide](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/using_selinux/configuring-selinux-for-applications-and-services-with-non-standard-configurations_using-selinux)** on 4 November 2026; `sshd -t`, multiple `Port` lines and the UFW rule (dry run) were tested on Ubuntu 24.04 LTS. Service restarts and the AlmaLinux steps were not tested.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.