How to Change Your SSH Port and Stop Getting Hammered by Bots

If you've ever run a Linux server, you know the drill. Within minutes of going live, your SSH logs start filling up with failed login attempts from random IPs trying "admin/admin" and "root/123456" on port 22. It's like leaving your front door open in a sketchy neighborhood—someone's going to try the handle.

The good news? Moving SSH off port 22 is stupidly effective at cutting down this noise. It won't make your server Fort Knox, but it'll filter out 99% of the automated garbage that's constantly knocking.

Why Port 22 Is a Bot Magnet

SSH (Secure Shell) is how you securely connect to remote servers. By default, it listens on port 22. And since every bot-herder and script kiddie knows this, that's exactly where they point their brute-force tools.

Think of it this way: if every house on the street has their spare key under the mat, thieves check there first. Port 22 is that mat. When you move SSH to something like port 5444 or 2222, most automated attacks just move on to easier targets.

Brute-force attacks work by trying thousands of username/password combos. When they're all aimed at port 22, your server logs get cluttered, your bandwidth gets chewed up, and you're at higher risk of a lucky guess.

Port scanners sweep through IP ranges looking for open port 22. If yours isn't there, you're basically invisible to the laziest attackers—which happen to be the most common ones.

👉 Looking for secure, high-performance servers that let you customize SSH configs without breaking a sweat?

Picking a New Port

Linux systems have 65,536 available ports split into three ranges. Ports 0-1023 are reserved for system services (like SSH on 22, HTTPS on 443), and typically need root privileges to bind.

You want something in the higher ranges—ideally above 1024—that isn't already claimed by another service. Common choices are 2222, 4444, or 5444 because they're easy to remember but not default for anything.

Before you commit, check what's already listening:

sudo lsof -i -P -n | grep LISTEN

This spits out every port currently in use. If you see port 5432 taken by PostgreSQL but 5444 is clear, you're good to go.

Opening the Port in Your Firewall

Once you've picked a port, you need to tell your firewall to allow traffic on it. Otherwise, you'll lock yourself out—trust me, it's not fun explaining that to support.

For iptables, run this:

sudo iptables -I INPUT -p tcp --dport 5444 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Then verify it's actually added:

sudo iptables -L

You should see a rule allowing traffic on your new port. If you're using UFW or firewalld, the commands are different but the idea's the same—whitelist before you switch.

Editing the SSH Config File

Now for the main event. SSH's config lives in /etc/ssh/sshd_config. Open it with your favorite editor:

sudo nano /etc/ssh/sshd_config

Look for a line that says:

#Port 22

That # means it's commented out, so SSH is using the default. Remove the #, change 22 to your new port, and save:

Port 5444

Pro tip: Before you save, take a backup of the config file. If you typo something, SSH might refuse to start, and then you're troubleshooting via a clunky web console.

Restarting SSH Without Locking Yourself Out

After editing the config, you need to restart the SSH service. The command depends on your distro.

For Debian/Ubuntu:

sudo service ssh restart

For CentOS/Fedora:

sudo systemctl restart sshd

Here's the nerve-wracking part: don't close your current SSH session yet. Open a new terminal and try connecting with the new port to make sure it works:

ssh username@server_ip -p 5444

If it connects, you're golden. If not, you still have your old session open to fix whatever went wrong.

👉 Need a VPS with rock-solid SSH access and firewall flexibility?

What Happens to the Old Port

Once SSH is listening on 5444, port 22 goes quiet. If you try connecting the old way:

ssh username@server_ip

You'll get a "Connection refused" error. That's exactly what you want—it means bots hitting port 22 are now just screaming into the void.

Is This Actually Secure?

Let's be real: changing ports is security through obscurity, not a bulletproof defense. If someone's specifically targeting you—not just running a script—they'll scan all your ports and find SSH wherever you moved it.

But here's the thing: 99% of SSH attacks are drive-by automation. They're not sophisticated. They're just bots trying the default setup on every IP they can reach. Moving off port 22 is like putting a "Beware of Dog" sign on your lawn—it doesn't stop a determined intruder, but it makes casual troublemakers move along.

You should still:

• Use key-based authentication instead of passwords

• Disable root login over SSH

• Set up fail2ban to auto-block repeated failed attempts

• Keep your system updated

Changing the port is one piece of a bigger security picture. It's not the whole puzzle, but it's a smart, low-effort piece.

Quick Recap

Moving SSH off port 22 takes about five minutes and dramatically cuts down on automated attacks. Here's the short version:

1. Pick a new port (check what's free with lsof)

2. Open it in your firewall (iptables or whatever you use)

3. Edit /etc/ssh/sshd_config and change the Port line

4. Restart SSH (service ssh restart or systemctl restart sshd)

5. Test the new connection before closing your old session

Your server logs will thank you, and you'll stop seeing hundreds of failed login attempts every day from random IPs in countries you've never heard of.

It's not a silver bullet, but it's a solid first step toward making your server less of an obvious target. And honestly, anything that keeps the bots away while you focus on actual work is worth doing.