SSH on Different Ports

Port 22 is convention, not law

SSH defaults to port 22, but the daemon will happily listen on any port you tell it. Moving SSH off 22 is not real security — a port scan finds it in seconds — but on a public-facing server it dramatically reduces automated brute-force noise. A server on :22 sees thousands of attempts a day; on :2222 maybe a handful.

Connecting to a non-default port

The -p flag on the client side, the Port directive in ~/.ssh/config, or the -P flag on scp (yes, capital P — scp is annoyingly different).

Changing the server's port

Edit /etc/ssh/sshd_config, change Port 22 to your chosen number, restart sshd. If your firewall is filtering, open the new port and (later) close 22. Always keep an existing connection open as a lifeline.

Code

Client side·bash

# Connect to a non-default port
ssh -p 2222 you_username@192.168.1.100

# In ~/.ssh/config — Track 3 covers this in depth
# Host office
#     HostName 192.168.1.100
#     Port 2222

# scp uses capital -P (because scp is petty)
scp -P 2222 file.txt you_username@192.168.1.100:/tmp/

Server side — change the listening port·bash

# Edit the daemon config
sudo nano /etc/ssh/sshd_config
# Change:
#   #Port 22
# To:
#   Port 2222

# Validate the config BEFORE restarting
sudo sshd -t

# Restart
# Linux
sudo systemctl restart sshd
# macOS — toggle Remote Login off/on in System Settings

# Open the firewall on the new port (Linux ufw)
sudo ufw allow 2222/tcp
# (Track 8 has full firewall coverage)

Exercise

On a test machine (NOT your only remote server), change the SSH port to 2222 with the steps above. Validate with sudo sshd -t first. Restart sshd. From a fresh terminal, confirm ssh -p 2222 user@host works and ssh -p 22 user@host does not. Bonus: add a Host entry in ~/.ssh/config with Port 2222 so you don't have to type -p every time. Revert when done if this isn't your final port choice.