{"id":1369,"date":"2026-09-03T11:37:30","date_gmt":"2026-09-03T06:07:30","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-change-ssh-port-linux-vps\/"},"modified":"2026-09-03T12:32:35","modified_gmt":"2026-09-03T07:02:35","slug":"how-to-change-ssh-port-linux-vps","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-change-ssh-port-linux-vps\/","title":{"rendered":"How to Change the Default SSH Port on Linux to Block 99% of Bot Scanners"},"content":{"rendered":"
\n

\n Quick Answer:<\/strong> To change the default SSH port on a Linux VPS, select an unused high port (such as 22022<\/code>), allow the new port in UFW (sudo ufw allow 22022\/tcp<\/code>), edit \/etc\/ssh\/sshd_config<\/code> to set Port 22022<\/code>, restart OpenSSH (sudo systemctl restart ssh<\/code>), and verify connection in a separate terminal before closing your active session.\n <\/p>\n<\/div>\n

Why Changing Port 22 Drastically Cuts Server Noise<\/h2>\n

While security professionals rightly note that changing the SSH port is “security through obscurity” rather than a standalone cryptographic barrier, moving SSH off standard port 22 immediately eliminates over 99% of automated credential stuffing bots<\/strong>. This keeps \/var\/log\/auth.log<\/code> clean, conserves CPU cycles, and prevents authentication log bloat.<\/p>\n

Step 1: Selecting a Safe Custom Port Number<\/h2>\n

Choose an unused port number between 1024 and 65535<\/strong> that does not conflict with common web services (avoid 80, 443, 3306, 5432, 8080, 8090). A great standard choice is 22022<\/code> or 49152<\/code>.<\/p>\n

Step 2: Opening the New Port in UFW & Cloud Security Groups<\/h2>\n

Warning:<\/strong> You must update your firewall rules BEFORE restarting SSH. If you restart SSH on a new port without updating your firewall, your server will drop the connection and lock you out.<\/p>\n

# Allow the new custom port in UFW\nsudo ufw allow 22022\/tcp\nsudo ufw status<\/pre>\n
If you are using AWS, Oracle Cloud, or Hetzner Cloud, also add an inbound security group rule allowing TCP traffic on port 22022<\/code> in your provider’s web console.<\/p>\n
Step 3: Updating OpenSSH Daemon Configuration<\/h2>\n
sudo nano \/etc\/ssh\/sshd_config<\/pre>\n
Locate the line #Port 22<\/code>, uncomment it, and update it to your new port:<\/p>\n
# OpenSSH Custom Port Setting\nPort 22022<\/pre>\n
Step 4: Testing the Configuration and Restarting SSH<\/h2>\n
Validate the syntax of your configuration file before reloading the daemon:<\/p>\n
# Validate syntax for errors\nsudo sshd -t\n\n# If no errors returned, restart the SSH service\nsudo systemctl restart ssh<\/pre>\n
Step 5: Verifying the Connection (Do Not Close Existing Window!)<\/h2>\n
Open a fresh terminal window on your local machine and test connecting on the new port with the -p<\/code> flag:<\/p>\n
ssh -p 22022 username@your-server-ip<\/pre>\n
Once connected successfully, you can safely remove port 22 from your firewall (sudo ufw delete allow 22\/tcp<\/code>).<\/p>\n
Configuring SSH Client Shortcuts in ~\/.ssh\/config<\/h2>\n
Once your SSH port is changed from 22 to 22022<\/code>, typing the port argument manually during every terminal session is tedious. You can configure a client alias on your local Windows, macOS, or Linux machine by editing ~\/.ssh\/config<\/code>:<\/p>\n
# Local ~\/.ssh\/config profile\nHost myvps\n    HostName 203.0.113.50\n    Port 22022\n    User deployer\n    IdentityFile ~\/.ssh\/id_ed25519\n    ServerAliveInterval 60<\/pre>\n
Now, simply executing ssh myvps<\/code> automatically routes your connection to port 22022 using your private key without typing IP addresses or port flags.<\/p>\n
SELinux Considerations on RHEL, AlmaLinux & Rocky Linux<\/h2>\n
If you are running enterprise RHEL-based distributions with SELinux in Enforcing mode, SELinux will block OpenSSH from binding to non-standard ports by default. Allow the custom port in SELinux policy before restarting the daemon:<\/p>\n
# Install SELinux management utilities\nsudo dnf install policycoreutils-python-utils -y\n\n# Add custom port 22022 to SSH port context\nsudo semanage port -a -t ssh_port_t -p tcp 22022\n\n# Verify SELinux SSH port assignments\nsudo semanage port -l | grep ssh<\/pre>\n
Step-by-Step Port Change for Ubuntu, Debian, AlmaLinux & CentOS<\/h2>\n
To ensure absolute compatibility across various Linux distributions, review the exact system requirements before altering your remote management port:<\/p>\n\n\n\n\n\n\n\n
Distribution<\/th>\nFirewall Tool<\/th>\nService Daemon Name<\/th>\nSELinux Enforcement<\/th>\n<\/tr>\n<\/thead>\n
Ubuntu 24.04 \/ 22.04<\/td>\nUFW<\/td>\nssh<\/code> or ssh.service<\/code><\/td>\nAppArmor (Default)<\/td>\n<\/tr>\n
Debian 12 \/ 11<\/td>\nUFW \/ nftables<\/td>\nssh.service<\/code><\/td>\nAppArmor<\/td>\n<\/tr>\n
AlmaLinux \/ Rocky Linux 9<\/td>\nfirewalld<\/td>\nsshd.service<\/code><\/td>\nSELinux Enforcing (Requires semanage)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Pairing Custom SSH Ports with Port Knocking & WireGuard VPNs<\/h2>\n
For high-security environments, changing the SSH port can be augmented with Port Knocking<\/strong> (using knockd<\/code>) or private network tunneling via WireGuard VPN<\/strong>. With WireGuard, you can close your SSH port to the public internet completely, allowing SSH connections only when authenticated to your private encrypted VPN mesh.<\/p>\n
Automating Port Change with Ansible Configuration Management<\/h2>\n
If you manage multiple cloud VPS instances across different cloud providers, updating the SSH configuration manually on every single server is error-prone. You can automate custom SSH port deployment using Ansible playbooks, ensuring idempotent configuration without risk of server lockouts:<\/p>\n
# Sample Ansible task for automated custom SSH port rollout\n- name: Allow custom SSH port in UFW\n  ufw:\n    rule: allow\n    port: '22022'\n    proto: tcp\n\n- name: Update OpenSSH port directive\n  lineinfile:\n    path: \/etc\/ssh\/sshd_config\n    regexp: '^#?Port '\n    line: 'Port 22022'\n    validate: '\/usr\/sbin\/sshd -t -f %s'\n  notify: restart ssh<\/pre>\n
Monitoring SSH Authentication Logs with Logwatch<\/h2>\n
To keep track of connection attempts and verify that bot traffic has ceased on port 22, install Logwatch to receive automated daily digest emails summarizing authentication successes and failures:<\/p>\n
sudo apt install logwatch -y\nsudo logwatch --detail High --service sshd --range today<\/pre>\n
\n
\n        \ud83d\udd17<\/span> Recommended Related Technical Guides:
\n    <\/h3>\n