Skip to content
Webmaster Tools
SecurityPort ScannerPort 22 (SSH)

Port 22 (SSH)

Port 22 is the default SSH port, used for remote shells, SFTP and Git. How to lock it down with keys, sshd_config and a firewall, and whether moving it helps.

What runs on port 22

TCP port 22 is the default port for SSH, the Secure Shell protocol (RFC 4253). It carries remote shell logins, file transfers with SFTP and SCP, Git over SSH (git@host:repo.git) and port forwarding. Everything on the connection is encrypted and the server proves its identity with a host key, so SSH is safe to expose, provided authentication is strong.

Should it be open to the internet?

On most servers, yes, because it is how you manage them. But port 22 is the most scanned port on the internet, and bots try password logins against it all day. Open it, but only with key-based logins, or restrict it to known addresses or a VPN when you can.

# ufw: allow SSH, with ufw's built-in rate limit
sudo ufw limit 22/tcp

# or only from your office network
sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp

# iptables: allow from one network, drop the rest
iptables -A INPUT -p tcp -s 203.0.113.0/24 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

Add the allow rule before enabling the firewall or dropping traffic, or you will lock yourself out of a remote machine.

Harden sshd_config

These lines in /etc/ssh/sshd_config stop the password guessing that fills most logs:

PermitRootLogin prohibit-password
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
AllowUsers deploy admin

Check the syntax with sudo sshd -t, then reload with sudo systemctl reload ssh (the unit is sshd on some distributions). Keep your current session open and test a new login in a second terminal before you log out. Older OpenSSH versions call KbdInteractiveAuthentication ChallengeResponseAuthentication.

Install your key first with ssh-copy-id user@example.com. The private key should be chmod 600 and ~/.ssh should be 700; see chmod 600 for why.

Moving SSH to another port

Changing Port 22 to something like Port 2222 cuts log noise from automated scans, but it is not a security control: a full port scan finds it in minutes. Keys and PasswordAuthentication no matter far more. If you do move it, open the new port in the firewall first. On recent Ubuntu releases sshd is started by systemd socket activation, so the listening port may come from ssh.socket rather than sshd_config; check which applies on your version.

See what is listening

sudo ss -tlnp 'sport = :22'
sudo lsof -i :22

To test from another machine: nc -zv example.com 22, or ssh -v user@example.com to watch the handshake. "Connection refused" means nothing listens there (or a firewall rejects); a timeout usually means a firewall silently drops the packets.

Security notes

  • fail2ban or ufw limit slows brute force, but disabling passwords ends it.
  • Host key warnings ("REMOTE HOST IDENTIFICATION HAS CHANGED") appear after a reinstall, and also in a real man-in-the-middle attack. Verify the new fingerprint before removing the old line from known_hosts.
  • Keep OpenSSH updated; serious bugs in sshd are rare but do happen.
  • Don't reuse keys across people. One key per person makes removing access simple.

To check which of your server's ports, including 22, answer from the public internet, run the Port Scanner.