How to change the default SSH port (22) and cut automated scanner noise

Port 22 is the default target of virtually every automated SSH scanner on the internet. Botnets like Mirai and its variants sweep the entire IPv4 range looking specifically for services exposed on 22 — not because it’s the only possible port, but because it’s the bet with the highest return. Result: even a freshly provisioned VPS accumulates hundreds of failed login attempts per hour in the logs before the first deploy.

Changing the default port isn’t real security against a targeted attacker. A full nmap -p- finds any SSH port in seconds. But the goal here is different: reduce operational noise. Fewer lines in /var/log/auth.log, fewer fail2ban triggers, less CPU spent rejecting obviously malicious connections. In tutorials that recommend this there’s a frequent trap: changing sshd_config alone doesn’t work on modern distros because systemd intercepts the port via socket activation.

This guide takes about 15 minutes and covers the full procedure on Ubuntu 22.04/24.04, Debian 12 and RHEL variants — including the systemd socket adjustment, firewall rules with UFW and firewalld, SELinux configuration when applicable, and the mandatory test before closing the current session.

Prerequisites

Choose the new port

The new port must be non-privileged (above 1024) to avoid requiring root for rebinds, and outside the range of well-known services. Recommended range: 1024–49151. Above 49152 is the ephemeral port range, which the kernel uses for outbound connections — it works, but technically competes with dynamic sockets.

Common options: 2200, 2222, 22022, 4422. Avoid ports associated with other services (3306 MySQL, 5432 PostgreSQL, 6379 Redis, 8080 HTTP alternative). For this tutorial we will use 2222 as an example — substitute the value you choose.

Before continuing, confirm the port is free on the server:

sudo ss -tlnp | grep :2222

Expected output: empty. If a process appears, choose another port.

Configure sshd

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

sudo nano /etc/ssh/sshd_config

Port 2222

sudo sshd -t

Adjust the systemd socket (critical step)

On Ubuntu 22.04+, Debian 12+ and some Fedora versions, SSH is activated via systemd socket. This means systemd listens on port 22 and only hands the connection to the daemon when it receives a request. Changing only sshd_config has no effect in this case — the socket stays on 22.

sudo systemctl status ssh.socket

sudo systemctl stop ssh.socket
sudo systemctl disable ssh.socket
sudo systemctl mask ssh.socket

sudo systemctl enable ssh

Open the new port in the firewall

This step needs to happen BEFORE restarting SSH. If you restart first, sshd will start listening on 2222 but the firewall will block connections — and your current session may become unstable during the restart.

sudo ufw allow 2222/tcp comment 'SSH custom port'

sudo ufw status numbered

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

SELinux (RHEL/CentOS/Rocky/AlmaLinux only)

On distros with SELinux in enforcing mode, the policy prevents sshd from binding to ports not labeled as ssh_port_t. Without this adjustment, the service fails to restart and the error appears in /var/log/audit/audit.log.

sudo dnf install -y policycoreutils-python-utils

sudo semanage port -a -t ssh_port_t -p tcp 2222

sudo semanage port -l | grep ssh

Restart and test

sudo systemctl restart ssh

sudo ss -tlnp | grep ssh

ssh -p 2222 user@your_vps_ip

Close the old port 22

Only do this step after confirming SSH works stably on 2222 for at least 10 minutes in an independent test session.

sudo ufw delete allow 22/tcp

Or on firewalld:

sudo firewall-cmd --permanent --remove-port=22/tcp
sudo firewall-cmd --reload

Confirm 22 no longer responds:

ss -tlnp | grep :22

Expected output: empty. From here on, any connection on 22 drops immediately at the firewall — exactly the behavior that reduces log noise.

Final verification

Confirm everything at once with a state snapshot:

sudo ss -tlnp | grep ssh
sudo systemctl status ssh
sudo ufw status

You should see: SSH listening only on 2222, service active (running), firewall with 2222/tcp allowed and 22/tcp absent. In 24 hours, compare the volume of failed attempts:

sudo journalctl -u ssh --since '24 hours ago' | grep -c 'Failed password'

Expected drop is 90%+ compared to the exposed 22 — the remainder are scanners that perform a range scan or have already mapped your IP.

Next steps

Changing the port is only the first level of hardening. Recommended next steps:

• Disable password authentication (PasswordAuthentication no in sshd_config) and use only SSH keys with ed25519.
• Configure fail2ban with a custom jail for the new port — the package default filter assumes 22 and requires an override.
• Restrict root login: PermitRootLogin prohibit-password (or no if you have a sudo user configured).
• Enable two-factor authentication via Google Authenticator (libpam-google-authenticator).
• Set up centralized logging to correlate attempts across multiple VPS.

If you’re running this in production, a Hostini VPS comes with native serial console access in the panel — so even if you lock yourself out by a firewall mistake, you can recover access without support. See the options at /vps.