Port Changing — Noise, Not Security

~10 min · sshd, non-default-port, obscurity

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

Why move SSH off port 22

Moving SSH to a non-default port (2222, 22022, anything memorable) is not real security — a scanner finds it within seconds. But it dramatically reduces background noise. A public-facing server on :22 sees thousands of brute-force attempts per day; on :2222, maybe a handful. With key-only auth, both are equally safe; the latter just produces less log noise to wade through.

Combined with the rest of this track

Port change alone is theater. Combined with key-only auth + fail2ban + firewall (next lesson) + restricted user list, you have a server that's quiet, brute-force-resistant, and hard to find. Each layer is small; the combination is what matters.

Code

Change the listening port·bash

# Edit
sudo nano /etc/ssh/sshd_config
# Change:
#   #Port 22
# To:
#   Port 2222

# ALWAYS validate before restarting
sudo sshd -t

# Restart
sudo systemctl restart sshd

Update everywhere it's referenced·bash

# Open the new port in the firewall
sudo ufw allow 2222/tcp
sudo ufw delete allow 22/tcp   # close the old one only after testing the new

# fail2ban: update the jail's `port = ssh` if you're using a non-named port
#   port = 2222

# Your ~/.ssh/config:
# Host server
#     Port 2222

# Connect manually
ssh -p 2222 user@host

# Or via scp (note CAPITAL P)
scp -P 2222 file.txt user@host:/tmp/

External links

sshd_config — Port directive

Exercise

On a test server (NOT your only remote box), change SSH from 22 to 2222 following the steps above. Validate (sshd -t), restart, test from a new terminal, then close port 22 in the firewall. Update your ~/.ssh/config Host block with Port 2222 so you stop typing -p. Watch the auth log over the next day — the noise drop is dramatic.