How to Change the SSH Port and Secure Your Server

Moving SSH off the standard port 22 removes most of the automated brute-force noise from your logs. It is not a replacement for keys and a firewall, but it is a useful addition. Here is how to do it without risking access to the server.

Step 1. Open the SSH configuration

sudo nano /etc/ssh/sshd_config

Find the Port line. It is often commented out:

#Port 22

Uncomment it and set a new port (pick a number between 1024 and 65535, for example 2222):

Port 2222

Step 2. Open the new port in the firewall

This step is critical. If ufw is enabled, allow the new port first, otherwise you lose access as soon as SSH restarts:

sudo ufw allow 2222/tcp

Check that the rule was added:

sudo ufw status

Step 3. Restart SSH and verify

Restart the service:

sudo systemctl restart ssh

Do not close your current session. Open a new terminal window and connect on the new port:

ssh -p 2222 deploy@YOUR_IP

If the connection works, you can close the old session and drop the rule for port 22:

sudo ufw delete allow OpenSSH

Extra baseline hardening

Changing the port is only one layer. Add a few more in sshd_config.

Forbid root login:

PermitRootLogin no

Disable password login (if keys are set up):

PasswordAuthentication no

Limit the list of users:

AllowUsers deploy

After editing, restart the service with sudo systemctl restart ssh.

Brute-force protection: fail2ban

fail2ban automatically blocks an IP after several failed login attempts:

sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban

To check the status of the SSH jail:

sudo fail2ban-client status sshd

Summary of the measures

Frequently asked questions

Does changing the port really protect the server? It hides SSH from mass scanners and cuts down the log volume, but it will not stop a targeted attack. Use it together with keys and fail2ban.

What if I lose access after changing the port? Connect through the KVM console in the server control panel, open sshd_config and restore a working port, or fix the firewall rule.

Which port should I choose? Any free port above 1024, so it does not collide with system services. Avoid ports of well-known services (80, 443, 3306).

Do I need fail2ban if password login is disabled? It is still useful: it reduces bot load and protects other services. With key-only access, though, password guessing is already impossible.

Summary

A new port, no root login, key-based access and fail2ban together give you solid baseline protection. The golden rule: always test the new connection in a separate session before closing the current one.

Ready to apply this on your own server? Take a Linux VPS, order VPS hosting, or order Server administration if you would rather leave hardening to specialists.