Changing the default SSH port on Ubuntu is a simple way to reduce unwanted connection attempts and make your server a little less exposed to automated scans. By default, OpenSSH listens on TCP port 22, which is well known and frequently targeted by bots scanning publicly accessible servers.
If you manage a VPS or a remote Ubuntu server, you have probably seen repeated SSH login attempts in your authentication logs. Most of these attempts come from automated scanners trying common usernames and passwords.
One practical step you can take is to move SSH to a different port, such as 2222.
In this guide, you’ll learn how to change the SSH port on Ubuntu 24.04, configure the firewall, handle systemd socket activation, and verify that your server accepts connections on the new port.
We’ll also cover a few common problems that can occur during the process, especially on newer Ubuntu installations.
Why Change the Default SSH Port?
OpenSSH uses port 22 by default. Because this port is widely known, automated scanners frequently check it when searching for publicly accessible SSH services.
Changing the port can help reduce:
- Automated login attempts targeting port 22.
- Unnecessary authentication requests in SSH logs.
- Background noise from bots scanning common SSH ports.
However, changing the SSH port is not a replacement for proper server security. It does not prevent targeted attacks or make weak passwords safe.
For better protection, combine a non-standard SSH port with SSH key authentication, strong access controls, and regular security updates.
If you haven’t configured SSH keys yet, follow our guide on How to Generate and Use SSH Keys on Ubuntu.
Step 1: Check Your Current SSH Configuration
Before making any changes, confirm that the OpenSSH server is installed and running.
Connect to your Ubuntu server and execute:
sudo systemctl status sshIf OpenSSH is not installed, you can install it with:
sudo apt update
sudo apt install openssh-serverYou can also check which port SSH is currently listening on:
sudo ss -tlnp | grep sshOn a standard installation, you should see SSH listening on port 22.
Before continuing, keep your current SSH session open. This is important because if something goes wrong, you can still use the existing connection to fix the configuration.
Step 2: Choose a New SSH Port
For this example, we’ll use port 2222.
You can choose another available port, but make sure it isn’t already being used by another service.
Check whether port 2222 is already occupied:
sudo ss -tuln | grep ':2222'If the command returns no output, the port is not currently shown as listening.
It’s also a good idea to check your firewall and hosting provider’s network security rules before proceeding.
Step 3: Configure the New SSH Port
Ubuntu allows you to configure OpenSSH through its main configuration file:
/etc/ssh/sshd_configIt also supports separate configuration files inside:
/etc/ssh/sshd_config.d/Using a separate configuration file is generally cleaner because your custom settings remain separate from the default configuration.
Create a new configuration file:
sudo nano /etc/ssh/sshd_config.d/00-custom-port.confAdd the following line:
Port 2222Save the file and exit the editor.
Important: Ubuntu’s OpenSSH configuration uses the first obtained value for most directives. If another included configuration file already defines a Port directive, check its order and contents to avoid conflicting settings.
You can inspect the effective SSH configuration with:
sudo sshd -T | grep '^port 'The expected output should include:
port 2222Step 4: Allow the New Port Through the Firewall
Changing the SSH configuration alone isn’t enough. Your firewall must also allow incoming connections to the new port.
If you’re using UFW, check its current status:
sudo ufw statusAllow TCP port 2222:
sudo ufw allow 2222/tcpVerify the new rule:
sudo ufw statusYou should see an entry allowing connections to port 2222.
If your VPS provider has an external firewall, security group, or network access control panel, make sure TCP port 2222 is also allowed there.
This is particularly important for cloud servers. A correctly configured Ubuntu firewall cannot override a connection blocked by your provider’s external firewall.
Keep port 22 open for now. Do not remove the existing SSH firewall rule until you’ve successfully tested the new port.
Step 5: Restart SSH and Apply the Changes
This is where Ubuntu 24.04 requires a little extra attention.
Newer Ubuntu installations can use systemd socket activation for OpenSSH. When this feature is active, systemd manages the listening socket, which means restarting only ssh.service might not apply the new port.
First, check whether SSH socket activation is enabled:
systemctl is-active ssh.socketIf ssh.socket is active
Run:
sudo sshd -tIf there is no output, the SSH configuration syntax is valid.
Next, reload the systemd configuration and restart the SSH socket:
sudo systemctl daemon-reload
sudo systemctl restart ssh.socketThis allows systemd to regenerate the SSH listening socket using the updated configuration.
If ssh.socket is inactive
You can restart the regular SSH service instead:
sudo systemctl restart ssh.serviceCheck the service status afterward:
sudo systemctl status sshYou should see that the SSH service is active.
Step 6: Verify That SSH Is Listening on the New Port
After applying the changes, verify that Ubuntu is listening on port 2222.
Run:
sudo ss -tlnp | grep ':2222'You should see a listening socket associated with port 2222.
You can also inspect the SSH socket directly:
sudo systemctl status ssh.socketIf everything is configured correctly, the new port should appear in the listening socket information.
If port 22 is still active, don’t close your current SSH session. Check the socket activation configuration and look for other Port directives that might override your settings.
Step 7: Connect to Ubuntu Using the New SSH Port
Now it’s time to test the connection.
Open a new terminal window on your local computer and connect using:
ssh -p 2222 username@server_ipReplace username with your Ubuntu account and server_ip with your server’s public IP address.
For example:
ssh -p 2222 [email protected]If you use SSH key authentication, the connection should work with your existing private key, provided the correct key is available to your SSH client.
You can also specify the private key explicitly:
ssh -i ~/.ssh/id_ed25519 -p 2222 username@server_ipIf the connection succeeds, congratulations! Your Ubuntu server is now accepting SSH connections through port 2222.
For more details about connecting remotely, see our tutorial on How to Connect to Ubuntu Server Using SSH.
Step 8: Remove the Old SSH Port Rule (Optional)
Once you’ve confirmed that you can connect successfully through port 2222, you can remove the old port 22 firewall rule if you no longer need it.
For UFW, run:
sudo ufw delete allow 22/tcpCheck the firewall rules again:
sudo ufw statusMake sure port 2222 remains allowed.
If your VPS provider has a separate firewall, remember to update those rules as well.
You should also review any monitoring systems, deployment scripts, backup jobs, or other applications that connect to your server through SSH. Update their port settings if necessary.
A Practical Note From Server Administration
One thing that can easily catch administrators off guard is assuming that restarting the SSH service always applies every configuration change.
I remember how easy it is to overlook this detail when managing remote Linux servers. You update the configuration, restart the service, and expect everything to work. Then you open another terminal, connect using the new port, and the connection simply times out.
The frustrating part is that the SSH configuration itself might be perfectly valid.
On Ubuntu 24.04, systemd socket activation can be responsible for this behavior. The listening socket may continue using its previous configuration even after the SSH service has been restarted.
The important lesson is to check both the SSH daemon configuration and the systemd socket.
For remote servers, I also recommend keeping an existing SSH session open while testing the new connection from another terminal. It takes a little longer, but it can save you from losing access to a VPS that you manage remotely.
Troubleshooting Common SSH Port Problems
If you cannot connect after changing the SSH port, here are some things worth checking.
1. Connection timed out
A timeout usually indicates that the connection isn’t reaching the SSH service.
Check:
- Whether TCP port 2222 is allowed in UFW.
- Whether your VPS provider allows incoming traffic on port 2222.
- Whether the SSH socket is listening on the expected port.
- Whether your network blocks outgoing connections to that port.
2. Connection refused
A connection refused error generally means that the destination is reachable, but nothing is accepting connections on the requested port.
Check the SSH service:
sudo systemctl status sshThen check the listening ports:
sudo ss -tlnp | grep sshIf SSH is still listening on port 22, revisit the configuration and socket activation steps.
You can also follow our troubleshooting guide: How to Fix SSH Connection Refused.
3. SSH configuration test fails
If SSH refuses to restart, check the configuration syntax:
sudo sshd -tThis command reports configuration errors that need to be fixed before the SSH daemon can start correctly.
Check the system logs for more details:
sudo journalctl -u ssh.service -n 50 --no-pagerFor socket-related problems, inspect:
sudo journalctl -u ssh.socket -n 50 --no-pager4. SSH still listens on port 22
If you’ve changed the port but SSH continues listening on port 22, check whether socket activation is enabled:
systemctl is-active ssh.socketIf it returns active, reload systemd and restart the socket:
sudo systemctl daemon-reload
sudo systemctl restart ssh.socketAlso inspect the configuration files for duplicate Port directives.
Frequently Asked Questions
1. What is the default SSH port on Ubuntu?
The default SSH port on Ubuntu is TCP port 22. OpenSSH uses this port unless a different port is configured.
2. Which port should I use for SSH?
You can use any available TCP port within the valid port range of 1–65535, provided it isn’t reserved or already occupied by another service. Port 2222 is a common alternative for SSH.
3. Does changing the SSH port make my server more secure?
Changing the default port can reduce automated scans and unwanted login attempts. However, it is not a substitute for SSH key authentication, disabling unnecessary password authentication, or keeping your server updated.
4. Do I need to change the SSH port in my firewall?
Yes. Your firewall must allow incoming TCP connections on the new SSH port. If you’re using a cloud VPS, check the provider’s external firewall or security group as well.
5. Why does Ubuntu 24.04 still use port 22 after changing sshd_config?
This can happen when systemd socket activation is enabled. In that situation, restarting ssh.service alone might not update the listening socket. Run sudo systemctl daemon-reload followed by sudo systemctl restart ssh.socket when socket activation is active.
6. Can I use SSH keys after changing the port?
Yes. Changing the SSH port does not invalidate your existing SSH keys. You only need to specify the new port when connecting:
ssh -p 2222 username@server_ip7. Can I change the SSH port without restarting the server?
You don’t need to reboot Ubuntu. You only need to apply the updated SSH configuration by restarting the appropriate SSH service or systemd socket.
Final Thoughts
Changing the SSH port on Ubuntu 24.04 is a straightforward configuration task, but it’s important to apply the changes correctly.
The key steps are updating the OpenSSH configuration, allowing the new port through your firewall, handling systemd socket activation when enabled, and testing the connection before removing the old port.
If you’re managing a production VPS, always keep an existing SSH session open until you’ve confirmed that the new port works.
A little preparation can prevent an unnecessary server access problem later.
If you’re building a more secure Ubuntu server, consider combining a non-standard SSH port with SSH key authentication and regular system maintenance.