How To Change Default SSH Port In Linux (Ubuntu, Debian, CentOS, AlmaLinux)

By default, the Secure Shell daemon (sshd) on Linux servers listens on TCP port 22. Because port 22 is globally standard, exposed servers face relentless automated password brute-force and dictionary attacks from internet botnets. Attackers scan public subnets 24/7, bloating your authentication log files (/var/log/auth.log or /var/log/secure) and consuming server CPU resources.

Changing your default SSH port to a non-standard port (such as 2222, 22222, or any custom port above 1024) eliminates over 98% of automated scanner noise. This step-by-step guide explains how to change the SSH port on Ubuntu, Debian, CentOS, AlmaLinux, and Rocky Linux without locking yourself out.

Safety checklist: Preventing SSH lockouts

Keep your current SSH session open: Never close your existing SSH terminal window until you have verified that a new terminal can connect over the new port.
Configure firewall rules BEFORE restarting SSH: Opening the new port in UFW, FirewallD, or iptables must be done before reloading the SSH service.
Choose an unassigned high port: Pick a port between 1024 and 65535 (e.g. 22222 or 45822) that is not used by web, mail, or database servers.
SELinux Considerations (RHEL / CentOS / AlmaLinux): If SELinux is active (enforcing), you must inform SELinux of the new port using semanage.

Step 1: Open the new port in your firewall FIRST

On Ubuntu / Debian (UFW):

sudo ufw allow 22222/tcp
sudo ufw reload

On CentOS / AlmaLinux / Rocky Linux (FirewallD):

sudo firewall-cmd --permanent --add-port=22222/tcp
sudo firewall-cmd --reload

On iptables:

sudo iptables -A INPUT -p tcp --dport 22222 -j ACCEPT

Step 2: Update SELinux policy (RHEL / CentOS / AlmaLinux only)

If you run a Red Hat-family distribution with SELinux enabled, allow SSH to bind to the non-standard port:

# Check if SELinux is enforcing
sestatus

# If Enforcing, register the new port with SELinux:
sudo semanage port -a -t ssh_port_t -p tcp 22222

# If semanage is missing, install policycoreutils:
sudo dnf install policycoreutils-python-utils -y

Step 3: Edit the SSH configuration file

Open the primary SSH daemon configuration in your preferred text editor:
```
sudo nano /etc/ssh/sshd_config
```
Locate the line containing #Port 22 near the top of the file.
Uncomment the line by removing the # character, and change the value to your custom port (e.g. Port 22222):
```
Port 22222
```
Save the file (Ctrl + O, then Enter) and exit (Ctrl + X).

Step 4: Test configuration syntax and restart SSH

Before restarting the daemon, test the config file for syntax errors:

sudo sshd -t

If the test returns no output, your syntax is valid. Restart the SSH service using systemd:

# On Ubuntu / Debian:
sudo systemctl restart ssh

# On CentOS / AlmaLinux / Rocky Linux:
sudo systemctl restart sshd

Step 5: Verify connection BEFORE closing your terminal

Do NOT close your current terminal window! Open a separate, new terminal window on your local computer and test logging in with the -p flag:

ssh root@YOUR_SERVER_IP -p 22222

If you log in successfully, you can now safely close port 22 on your firewall and close your old terminal session:

# On UFW:
sudo ufw delete allow 22/tcp

# On FirewallD:
sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --reload

Emergency rescue: What to do if locked out?

If you made a typo or your firewall blocked the connection, you can regain control in seconds via the Aminserve Client Portal using our out-of-band VNC Console. See our step-by-step VNC Console emergency rescue guide.