--- title: "How to Change the SSH Port on Ubuntu 24.04 and Rocky Linux" description: "Move SSH from port 22 to a custom port on Ubuntu 24.04, Debian 12 or Rocky Linux 9 without getting locked out, updating the firewall, SELinux and Fail2Ban." category: "Server Setup" language: en source: https://cubepath.com/docs/server-setup/how-to-change-the-default-ssh-port updated: 2026-09-25 --- # How to Change the SSH Port on Ubuntu 24.04 and Rocky Linux Almost every automated SSH scan on the Internet targets port 22. Moving SSH to another port does not make the server more secure against a targeted attack, but it removes most of the brute-force noise from your logs and from Fail2Ban. In this tutorial you will add a new SSH port alongside port 22, open it in the firewall (and in SELinux on Rocky Linux), test it, and only then close port 22. The steps cover Ubuntu 24.04, which uses systemd socket activation for SSH, as well as Debian 12 and Rocky Linux 9. ## Prerequisites To follow this guide you need: - A server running Ubuntu 24.04 LTS, Debian 12 or Rocky Linux 9, for example a CubePath VPS. - A non-root user with `sudo` privileges and working SSH access. - Access to the server's web console (on CubePath, the VNC console in the dashboard). If something goes wrong, it is your way back in. > Important: Keep your current SSH session open during the whole procedure. Existing sessions are not affected by a port change, so it lets you fix mistakes. This guide uses port `2222` as an example. Replace it with your own `your_port` everywhere. ## Step 1 - Choosing a free port Pick a port between 1024 and 65535 that no other service on the server uses and that your own network allows outbound (some corporate and hotel networks block unusual ports). Check that nothing listens on it yet: ```bash sudo ss -tlnp | grep ':2222 ' ``` No output means the port is free. Also check that no Port directive is already set elsewhere, since you will add yours to the main file: ```bash sudo grep -Rni '^ *Port ' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ ``` If this prints a line, change the port in that file instead of adding a new one. ## Step 2 - Adding the new port to the SSH configuration Back up the configuration first: ```bash sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak ``` Open the main configuration file: ```bash sudo nano /etc/ssh/sshd_config ``` Find the commented line `#Port 22` near the top. Replace it with two lines, so SSH listens on both ports during the transition: ```text Port 22 Port 2222 ``` Save the file and check the syntax. `sshd -t` prints nothing if the file is valid: ```bash sudo sshd -t ``` Nothing changes until you restart the service in Step 5, so first make sure the new port will be reachable. ## Step 3 - Allowing the port in the firewall Open the new port before SSH starts listening on it. ### Ubuntu and Debian with UFW ```bash sudo ufw allow 2222/tcp comment 'SSH' sudo ufw status ``` ```output Status: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere 2222/tcp ALLOW Anywhere # SSH OpenSSH (v6) ALLOW Anywhere (v6) 2222/tcp (v6) ALLOW Anywhere (v6) # SSH ``` If UFW shows `Status: inactive`, the rule is stored and will apply when you enable UFW. ### Rocky Linux with firewalld ```bash sudo firewall-cmd --permanent --add-port=2222/tcp sudo firewall-cmd --reload sudo firewall-cmd --list-ports ``` ```output 2222/tcp ``` ## Step 4 - Allowing the port in SELinux (Rocky Linux only) On Rocky Linux, SELinux only lets `sshd` bind to ports labelled `ssh_port_t`. Without this step the service fails to start on the new port with a `Permission denied` error. Skip it on Ubuntu and Debian. Install the `semanage` tool if it is missing and add the label: ```bash sudo dnf install -y policycoreutils-python-utils sudo semanage port -a -t ssh_port_t -p tcp 2222 ``` If the port already belongs to another SELinux type, `-a` fails with `already defined`. In that case modify it instead with `sudo semanage port -m -t ssh_port_t -p tcp 2222`. Verify: ```bash sudo semanage port -l | grep ssh_port_t ``` ```output ssh_port_t tcp 2222, 22 ``` ## Step 5 - Restarting SSH How you apply the change depends on the distribution. ### Ubuntu 24.04 Ubuntu 24.04 starts SSH through **socket activation**: systemd, not `sshd`, owns the listening socket in `ssh.socket`, and a generator creates the socket's port list from `sshd_config`. Check whether your server uses it: ```bash systemctl is-active ssh.socket ``` If the answer is `active`, regenerate the socket configuration and restart the socket: ```bash sudo systemctl daemon-reload sudo systemctl restart ssh.socket ``` If the answer is `inactive` (some images disable socket activation), restart the service instead: ```bash sudo systemctl restart ssh ``` ### Debian 12 ```bash sudo systemctl restart ssh ``` ### Rocky Linux 9 ```bash sudo systemctl restart sshd ``` Now confirm that SSH listens on both ports: ```bash sudo ss -tlnp | grep -E ':(22|2222) ' ``` ```output LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1021,fd=3),("systemd",pid=1,fd=86)) LISTEN 0 4096 0.0.0.0:2222 0.0.0.0:* users:(("sshd",pid=1021,fd=4),("systemd",pid=1,fd=87)) LISTEN 0 4096 [::]:22 [::]:* users:(("sshd",pid=1021,fd=5),("systemd",pid=1,fd=88)) LISTEN 0 4096 [::]:2222 [::]:* users:(("sshd",pid=1021,fd=6),("systemd",pid=1,fd=89)) ``` The process names differ between distributions (on Debian and Rocky Linux only `sshd` appears). What matters is that both ports are listed. ## Step 6 - Testing the new port From a **new terminal on your local computer**, connect on the new port: ```bash ssh -p 2222 your_user@your_server_ip ``` The first connection on a new port may ask you to confirm the host key again. The key itself has not changed, so the fingerprint is the same one you accepted before. Continue only when you get a shell. If the connection times out, the firewall is still blocking the port. If it is refused, SSH is not listening on it. See Troubleshooting before going further. ## Step 7 - Closing port 22 With the new port confirmed, remove port 22 from SSH. Open the configuration again: ```bash sudo nano /etc/ssh/sshd_config ``` Delete the `Port 22` line and keep only: ```text Port 2222 ``` Check the syntax: ```bash sudo sshd -t ``` Apply the change with the same command you used in Step 5. On Ubuntu 24.04 with socket activation that is: ```bash sudo systemctl daemon-reload sudo systemctl restart ssh.socket ``` On Debian 12 (or Ubuntu without socket activation) run `sudo systemctl restart ssh`, and on Rocky Linux `sudo systemctl restart sshd`. Then remove the old firewall rule. On Ubuntu and Debian: ```bash sudo ufw delete allow OpenSSH sudo ufw status ``` If you had created the rule as `ufw limit OpenSSH`, delete it with `sudo ufw delete limit OpenSSH` instead. On Rocky Linux: ```bash sudo firewall-cmd --permanent --remove-service=ssh sudo firewall-cmd --reload sudo firewall-cmd --list-all ``` Leave the `22` entry in the SELinux `ssh_port_t` list: it is part of the base policy and cannot be removed. Confirm that SSH now listens only on the new port, and test once more from a new local terminal: ```bash sudo ss -tlnp | grep sshd ``` ```bash ssh -p 2222 your_user@your_server_ip ``` ## Step 8 - Updating Fail2Ban If you run Fail2Ban, its `sshd` jail bans addresses on port 22 by default, so bans would not affect the new port. Open your local jail configuration: ```bash sudo nano /etc/fail2ban/jail.local ``` Add the port to the `[sshd]` section: ```ini [sshd] enabled = true port = 2222 ``` Restart Fail2Ban and confirm the jail is running: ```bash sudo systemctl restart fail2ban sudo fail2ban-client status sshd ``` ## Step 9 - Updating your SSH client Typing `-p 2222` every time is easy to forget. Save the port in your local `~/.ssh/config`: ```bash nano ~/.ssh/config ``` ```text Host myserver HostName your_server_ip User your_user Port 2222 ``` Now `ssh myserver` uses the right port, and so do tools that go through SSH: ```bash scp ./file.txt myserver:/tmp/ rsync -avz ./site/ myserver:/var/www/site/ ``` When you do not use an alias, remember that `scp` takes the port with a capital `-P` (`scp -P 2222 ...`) and `rsync` needs `-e "ssh -p 2222"`. ## Troubleshooting **SSH still listens only on port 22 on Ubuntu 24.04**: the socket was not regenerated. Run `sudo systemctl daemon-reload` and `sudo systemctl restart ssh.socket`, then check with `systemctl cat ssh.socket` that the generated drop-in lists your port. **`Connection timed out` on the new port**: the firewall is dropping it. Check `sudo ufw status` or `sudo firewall-cmd --list-ports`. If your provider or network has a firewall in front of the server, allow the port there as well. **`sshd` fails to start on Rocky Linux**: look at the error with `sudo journalctl -u sshd -n 20`. `error: Bind to port 2222 on 0.0.0.0 failed: Permission denied` means the SELinux label from Step 4 is missing. **Locked out completely**: log in through the web console and restore the backup, then restart SSH as in Step 5: ```bash sudo cp /etc/ssh/sshd_config.bak /etc/ssh/sshd_config ``` Make sure port 22 is allowed again in the firewall (`sudo ufw allow OpenSSH` or `sudo firewall-cmd --permanent --add-service=ssh` followed by `--reload`). ## Conclusion SSH now listens only on your custom port, the firewall and SELinux allow it, Fail2Ban watches the right port, and your client knows how to connect. Keep in mind that a port change only reduces noise: the real protection comes from key-only authentication, disabled root login and Fail2Ban. Good next steps are disabling password logins if you have not yet, restricting SSH in the firewall to your own IP ranges where possible, and reviewing `journalctl -u ssh` periodically for unexpected logins.