How to Change the Default SSH Port on Linux to Block 99% of Bot Scanners

Why Changing Port 22 Drastically Cuts Server Noise

While security professionals rightly note that changing the SSH port is “security through obscurity” rather than a standalone cryptographic barrier, moving SSH off standard port 22 immediately eliminates over 99% of automated credential stuffing bots. This keeps /var/log/auth.log clean, conserves CPU cycles, and prevents authentication log bloat.

Step 1: Selecting a Safe Custom Port Number

Choose an unused port number between 1024 and 65535 that does not conflict with common web services (avoid 80, 443, 3306, 5432, 8080, 8090). A great standard choice is 22022 or 49152.

Step 2: Opening the New Port in UFW & Cloud Security Groups

Warning: You must update your firewall rules BEFORE restarting SSH. If you restart SSH on a new port without updating your firewall, your server will drop the connection and lock you out.

# Allow the new custom port in UFW
sudo ufw allow 22022/tcp
sudo ufw status

If you are using AWS, Oracle Cloud, or Hetzner Cloud, also add an inbound security group rule allowing TCP traffic on port 22022 in your provider’s web console.

Step 3: Updating OpenSSH Daemon Configuration

sudo nano /etc/ssh/sshd_config

Locate the line #Port 22, uncomment it, and update it to your new port:

# OpenSSH Custom Port Setting
Port 22022

Step 4: Testing the Configuration and Restarting SSH

Validate the syntax of your configuration file before reloading the daemon:

# Validate syntax for errors
sudo sshd -t

# If no errors returned, restart the SSH service
sudo systemctl restart ssh

Step 5: Verifying the Connection (Do Not Close Existing Window!)

Open a fresh terminal window on your local machine and test connecting on the new port with the -p flag:

ssh -p 22022 username@your-server-ip

Once connected successfully, you can safely remove port 22 from your firewall (sudo ufw delete allow 22/tcp).

Configuring SSH Client Shortcuts in ~/.ssh/config

Once your SSH port is changed from 22 to 22022, typing the port argument manually during every terminal session is tedious. You can configure a client alias on your local Windows, macOS, or Linux machine by editing ~/.ssh/config:

# Local ~/.ssh/config profile
Host myvps
    HostName 203.0.113.50
    Port 22022
    User deployer
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 60

Now, simply executing ssh myvps automatically routes your connection to port 22022 using your private key without typing IP addresses or port flags.

SELinux Considerations on RHEL, AlmaLinux & Rocky Linux

If you are running enterprise RHEL-based distributions with SELinux in Enforcing mode, SELinux will block OpenSSH from binding to non-standard ports by default. Allow the custom port in SELinux policy before restarting the daemon:

# Install SELinux management utilities
sudo dnf install policycoreutils-python-utils -y

# Add custom port 22022 to SSH port context
sudo semanage port -a -t ssh_port_t -p tcp 22022

# Verify SELinux SSH port assignments
sudo semanage port -l | grep ssh

Step-by-Step Port Change for Ubuntu, Debian, AlmaLinux & CentOS

To ensure absolute compatibility across various Linux distributions, review the exact system requirements before altering your remote management port:

Pairing Custom SSH Ports with Port Knocking & WireGuard VPNs

For high-security environments, changing the SSH port can be augmented with Port Knocking (using knockd) or private network tunneling via WireGuard VPN. With WireGuard, you can close your SSH port to the public internet completely, allowing SSH connections only when authenticated to your private encrypted VPN mesh.

Automating Port Change with Ansible Configuration Management

If you manage multiple cloud VPS instances across different cloud providers, updating the SSH configuration manually on every single server is error-prone. You can automate custom SSH port deployment using Ansible playbooks, ensuring idempotent configuration without risk of server lockouts:

# Sample Ansible task for automated custom SSH port rollout
- name: Allow custom SSH port in UFW
  ufw:
    rule: allow
    port: '22022'
    proto: tcp

- name: Update OpenSSH port directive
  lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^#?Port '
    line: 'Port 22022'
    validate: '/usr/sbin/sshd -t -f %s'
  notify: restart ssh

Monitoring SSH Authentication Logs with Logwatch

To keep track of connection attempts and verify that bot traffic has ceased on port 22, install Logwatch to receive automated daily digest emails summarizing authentication successes and failures:

sudo apt install logwatch -y
sudo logwatch --detail High --service sshd --range today

Frequently Asked Questions