iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Change the SSH port in a controlled sequence: choose an unused port, back up and validate /etc/ssh/sshd_config, open the new port before switching, apply the correct systemd socket change on newer Ubuntu releases, verify the listener, and test from a second terminal before removing port 22. Keep your current SSH session and your provider’s web or VNC console available throughout.
What changing the SSH port does—and does not do
SSH normally listens on TCP port 22. Changing that listener to another port means clients must specify the new value, for example ssh -p 2222 user@server_ip. It can reduce noise from automated scans aimed at port 22, but it is not a replacement for key-based authentication, updates, least-privilege accounts, or a firewall. The procedure below changes the network endpoint; it does not change users, keys, host keys, or SSH authentication policy.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Every client and automation job that connects to the VPS must know the new port. That includes deployment tools, backup scripts, monitoring checks, configuration-management systems, and any administrator’s local SSH profile. A port change is therefore a small infrastructure change, not merely a line edited on the server.
Check your platform before editing anything
The service model matters more than the distribution name alone. On Ubuntu 22.10 and later, guides report that systemd socket activation commonly makes ssh.socket the owner of the listening port. In that arrangement, editing sshd_config and restarting only ssh.service can leave port 22 listening. Ubuntu 24.04 guidance is inconsistent: some instructions say the socket picks up the configured port automatically, while others report that an explicit socket override is still required. Treat the listener check as the authority on your machine.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
You can inspect the units before changing them with systemctl status ssh.socket and systemctl status ssh. The important question is not whether a restart command completed, but which unit owns the listening endpoint. After the change, ss -tlnp provides the practical confirmation.
| System | First procedure to try | Important qualification |
|---|---|---|
| Ubuntu 22.10 and newer | Edit sshd_config, validate, open the firewall, run daemon-reload, and restart ssh.socket. |
Restarting only ssh.service may not move the listener. |
| Ubuntu 24.04 | Use the same socket-aware procedure and verify with ss. |
Published instructions conflict on whether an override is needed; add one only if verification shows port 22 remains. |
| Ubuntu 22.04 and older, or systems without socket activation | Edit Port, validate, open the firewall, and restart the SSH service. |
Confirm the actual listener rather than assuming the service model. |
| RHEL-family systems with SELinux enforcing | Change the SSH configuration and firewall as appropriate for that distribution. | Port labelling with semanage may be required, but the exact requirement is not established here; consult your distribution’s SELinux documentation before switching. |
Prepare a safe change window
- Keep the current SSH connection open. Do not close it until a separate connection succeeds on the new port.
- Know the out-of-band route. Sign in to the VPS provider’s web console, serial console, or VNC console before you begin so a firewall or syntax mistake is recoverable.
- Account for external firewalls. A cloud security group or provider-level firewall is separate from the VPS firewall. If one exists, allow the new TCP port there as well. Provider-level handling varies and is not controlled by UFW.
- Choose a free high port. Examples used in common procedures are
2222and52022. Avoid a port already used by another service and avoid well-known service ports.
Write down the old and new values before editing. This prevents a later rollback from depending on memory, especially if another administrator is helping through the provider console. Schedule the change when you can keep both terminals open and observe the result rather than making the edit during an unattended maintenance window.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchStep-by-step: move SSH to a new port
1. Back up the SSH daemon configuration
From the existing session, create a copy that can be restored from the console if necessary:
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bakKeep the backup until you have logged in successfully on the new port and confirmed that the firewall rules are correct. If you later create a socket override, record that separately too; restoring the main file alone does not remove a systemd listener override.
2. Find every active Port setting
Ubuntu’s default file begins with an include for /etc/ssh/sshd_config.d/*.conf. OpenSSH generally uses the first value it encounters for a directive, so a drop-in can silently win over a later line in the main file. Inspect the main file and the drop-in directory before deciding where to make the change. Remove or edit conflicting active Port lines so the intended value is the first effective one.
sudo grep -nE '^[[:space:]]*Port[[:space:]]+' /etc/ssh/sshd_config
sudo grep -RInE '^[[:space:]]*Port[[:space:]]+' /etc/ssh/sshd_config.d/ 2>/dev/nullComments beginning with # are examples, not active settings. If you use a drop-in, a clearly named file such as /etc/ssh/sshd_config.d/99-port.conf is easier to manage than editing a vendor file, but verify the include order and make sure another earlier drop-in is not setting a different port.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Do not assume that seeing the desired line in the main file proves it is effective. The first active value encountered can take precedence, which is why a seemingly correct edit may appear to have no effect. Keep one deliberate active port value wherever possible and leave explanatory comments only on inactive examples.
3. Set the new port
Edit the main file or create the chosen drop-in. For port 2222, the active directive is:
Port 2222Do not delete the backup or close the current session. At this point the daemon configuration has changed, but the network listener and firewalls may still be on port 22.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
4. Validate before applying
Syntax-check the configuration while the old session is still available:
sudo sshd -tNo output normally indicates a successful check. Any error must be corrected before reloading or restarting. A failed check is a configuration problem, not a reason to force a restart; restore the backup from the console if you cannot identify the bad line.
Validation checks syntax, not reachability. A clean result does not confirm that UFW, a provider firewall, or the systemd socket is using the same port. Those checks come later, and all of them are required before port 22 can safely be removed.
5. Open the new port before moving the listener
With UFW, allow the new TCP port first:
sudo ufw allow 2222/tcpKeep the existing port 22 rule in place. If your VPS is behind a provider firewall or security group, create the equivalent inbound rule there before continuing. A UFW rule cannot open a port that is blocked outside the virtual machine.
Check the resulting rules with:
sudo ufw statusThe new rule should be visible before you restart anything. Guidance differs on whether an explicit ufw reload is necessary after adding a rule; use the status output and an actual connection test rather than assuming a reload alone proves access.
6. Apply the change on Ubuntu 22.10 and later
Reload systemd’s unit definitions and restart the socket that owns the listening endpoint:
sudo systemctl daemon-reload
sudo systemctl restart ssh.socketRestarting only ssh.service is reported as insufficient on socket-activated installations because ssh.socket can continue listening on its previous port and start sshd for each connection.
If the socket restart reports an error, do not close the working connection. Read the status output, run sudo sshd -t again, and check for a conflicting drop-in. The original session gives you time to correct the problem without turning a recoverable mistake into a lockout.
7. Apply the change on older or non-socket-activated systems
On Ubuntu 22.04 and older, or on a system where SSH is not socket-activated, restarting the SSH service after a successful syntax check is generally sufficient:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
sudo systemctl restart sshIf you are unsure which model is active, use the listener test in the next step. If port 22 remains open when you expected only the new port, return to the socket-override procedure rather than repeatedly restarting the service.
8. Confirm which ports are actually listening
Check both the old and new values:
sudo ss -tlnp | grep -E ':(22|2222)b'Replace 2222 in the expression if you chose another port. The output should show the new port associated with the SSH listener. If both ports appear, SSH may intentionally be listening on both, or a second configuration source may still be active. If only 22 appears, the socket unit or an overriding configuration has not been changed.
Run this check after every service or socket adjustment. A successful systemd command is not enough: the kernel’s listening sockets are the decisive evidence. Capture the output in your change notes so you know exactly which endpoint was active before the second-terminal test.
9. Test from a second terminal
Open a new terminal or a separate connection window while leaving the original session untouched:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ssh -p 2222 user@server_ipUse the same account and authentication method that normally work. A successful login proves that the daemon, the VM firewall, any external firewall, and the client route all agree on the new port. Only after this test succeeds should you remove port 22.
If the command hangs, treat it as a filtering or routing problem and inspect both firewall layers. If it immediately reports refusal, inspect the listener and socket restart. Do not solve either symptom by closing the original session; it is your recovery path.
10. Remove port 22 last
Delete the old UFW allowance only after the second session is active:
sudo ufw delete allow 22/tcp
sudo ufw statusIf your provider firewall has a separate port-22 rule, remove that rule there as well. Keep the verified new-port rule. Do not terminate the original session until you have confirmed that the second session remains usable after the firewall change.
Recommended Free Tools
If Ubuntu is still listening on port 22
Do not edit /lib/systemd/system/ssh.socket directly. Vendor unit files can be replaced during upgrades. Use a systemd drop-in under /etc/systemd/system/ instead.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Create a socket override
Open an override editor:
sudo systemctl edit ssh.socketIn the editor, add:
[Socket]
ListenStream=
ListenStream=2222The empty ListenStream= clears the inherited listener; the following line defines the new one. Save and exit, then apply the override:
sudo systemctl daemon-reload
sudo systemctl restart ssh.socketRun the ss check again. Published Ubuntu instructions disagree about whether this override is required on every 24.04 installation, so use it as a targeted remedy when the listener test demonstrates that the socket still owns port 22. An override is preferable to changing the vendor unit because it survives package updates.
After creating an override, remember that changing sshd_config later does not automatically remove the socket’s explicit ListenStream. Keep the override documented with the server configuration. If you revert to the standard port, remove or correct the override, run daemon-reload, restart ssh.socket, and verify the resulting listener before changing firewall rules.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsFirewall and connection failure diagnosis
| Symptom | Likely cause | Action while the original session is open |
|---|---|---|
| New connection times out | The new port is blocked by UFW, a provider firewall, or a security group. | Confirm sudo ufw status, verify the provider-level rule, and add sudo ufw allow 2222/tcp if it is missing. |
| “Connection refused” on the new port | No process is listening there, or the socket restart failed. | Run sudo ss -tlnp | grep -E ':(22|2222)b'; validate with sudo sshd -t; then apply the correct service or socket restart. |
| Port 22 still appears | ssh.socket retained the old listener, or a configuration drop-in supplied another value. |
Inspect all Port lines, reload systemd, restart ssh.socket, and use a drop-in override if necessary. |
| The restart reports a configuration error | An invalid directive or syntax error was introduced. | Keep the session open, run sudo sshd -t, correct the line, or restore /etc/ssh/sshd_config.bak from the console and retest. |
| You closed the only SSH session | The new path was not verified before the old path was removed. | Use the provider’s web, serial, or VNC console. Restore the backup or firewall rule, validate, and repeat the sequence. |
When diagnosing, change one layer at a time: effective SSH configuration, systemd socket state, the VPS firewall, and then the provider firewall. This order makes it easier to identify whether the failure is a daemon problem or a network-filtering problem. Keep port 22 temporarily available while you inspect each layer.
Common mistakes to avoid
- Changing the firewall after the listener. Opening the new port first prevents an otherwise valid SSH daemon from becoming unreachable.
- Restarting only
ssh.serviceon a socket-activated host. The socket, not just the service, controls the listening endpoint. - Assuming the main file is the only configuration. The default include directory can contain an earlier active
Portvalue. - Editing a vendor unit. Direct edits under
/lib/systemd/system/can disappear during an upgrade; usesystemctl edit ssh.socket. - Closing the working session immediately. A successful restart is not proof that a new connection can traverse every firewall layer.
- Removing 22 from only one firewall layer. UFW and a cloud security group are separate controls; update both when both exist.
- Using a port already claimed by another service. Confirm the selected endpoint is free before assigning it to SSH.
- Forgetting client configuration. Update scripts, monitoring, backup jobs, and local SSH profiles so they use the new value.
Rollback procedure
If the new port fails and you still have the original session, restore service before investigating further:
- Reopen port 22 if you removed it:
sudo ufw allow 22/tcp. - Restore the configuration if needed:
sudo cp /etc/ssh/sshd_config.bak /etc/ssh/sshd_config. - Run
sudo sshd -t. - On a socket-activated system, remove or correct the
ssh.socketoverride, runsudo systemctl daemon-reload, and restartssh.socket. On an older or non-socket-activated system, restartssh. - Verify port 22 with
sudo ss -tlnp | grep -E ':(22|2222)b'before closing the session.
If no SSH session remains, use the provider console to perform the same rollback. Console access is why it should be tested before making a remote firewall change. If a provider-level rule was changed, restore that rule as well; changing UFW alone cannot repair an upstream block.
After the port change: security checks
Changing the port is one small part of SSH hardening. Confirm that your normal security controls remain in place: use key authentication where possible, disable unnecessary accounts, apply operating-system and OpenSSH updates, and restrict inbound access with firewall rules or trusted source ranges when your workload allows it. The port number itself is not an authentication control.
Document the final port in your administrator runbook, monitoring checks, backup scripts, and automation. Every future client command must include the new port explicitly unless it is added to the client’s SSH configuration. Keep the exact value and the date of the change with your VPS inventory so another administrator does not assume that port 22 is still valid.
For repeated administrative use, a local SSH config entry can avoid typing the option each time:
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Host my-vps
HostName server_ip
User user
Port 2222Then connect with ssh my-vps. This is a client convenience only; it does not alter the server and does not remove the need to update unattended tools that use their own connection settings.
Quick completion checklist
- New port selected and confirmed free.
- Current SSH session and provider console available.
/etc/ssh/sshd_configbacked up.- Drop-in files checked for an earlier
Portdirective. sudo sshd -tcompletes successfully.- New port opened in UFW and any external firewall.
ssh.socketreloaded and restarted where socket activation is used.sudo ss -tlnpshows the intended listener.- Second-terminal login with
ssh -p NEWPORT user@server_ipsucceeds. - Port 22 removed only after verification.
- Client scripts, monitoring, and runbooks record the new port.
Frequently Asked Questions
Why is Ubuntu still listening on port 22 after I changed sshd_config?
On Ubuntu 22.10 and later, ssh.socket may own the listening endpoint. Run sudo systemctl daemon-reload and sudo systemctl restart ssh.socket, then check sudo ss -tlnp. Also inspect /etc/ssh/sshd_config.d/ for an earlier active Port directive.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do I need a socket override on Ubuntu 24.04?
Instructions differ. First change and validate sshd_config, restart the socket, and inspect the actual listener. If port 22 remains, create a systemctl edit ssh.socket override with an empty ListenStream= followed by ListenStream=NEWPORT.
Can I close my current SSH session as soon as the restart succeeds?
No. Leave it open until a second terminal successfully connects with ssh -p NEWPORT user@server_ip and remains usable after firewall changes. Keep provider web, serial, or VNC console access available as a fallback.
Should I remove port 22 from UFW before testing the new port?
No. Allow the new port first and keep port 22 open during the test. Remove the old UFW rule only after the second connection works; update any separate provider firewall rule too.
What does a timeout versus connection refusal mean?
A timeout commonly indicates filtering by UFW or an external firewall. Connection refused usually means nothing is listening on the new port or the socket restart failed. Check sudo ufw status, sudo sshd -t, and sudo ss -tlnp while the original session remains open.
What if I accidentally lock myself out?
Use the VPS provider’s web, serial, or VNC console. Reopen port 22, restore /etc/ssh/sshd_config.bak if needed, validate with sudo sshd -t, correct or remove the socket override, restart the appropriate unit, and verify the listener before trying SSH again.
The Bottom Line
Change the configuration, validate it, open the new firewall path, and then move the listener. On Ubuntu 22.10 and newer, restart ssh.socket rather than relying on ssh.service alone. Verify with ss, test from a second terminal, and remove port 22 only after the new connection is proven.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
