SSH default port is 22 - the official IANA-registered port and the value every SSH client tries first. Changing it to 2222 (or any non-standard port) reduces drive-by scans from bots that crawl IPv4 looking for 22, but it adds a step for every legitimate user: the -p 2222 flag or a ~/.ssh/config entry. The team that runs a public-facing server picks one and sticks with it. The team that flips between ports has the worst of both worlds.
Table of contents
- Why port 22
- The ‘change to 2222’ argument
- The ‘just leave it’ argument
- When the right answer is a non-standard port
- Configuring multiple ports
- How clients handle non-standard ports
- FAQ
Why port 22
Port 22 is the IANA-registered port for SSH since 1995. The IANA assignment predates most of the modern internet. Every SSH client assumes 22 by default - ssh user@host without -p connects to 22.
The team that changes the server’s port to something else forces every client to remember the new value. That is fine for an internal team of three. It is friction for a public service with thousands of users.
The history: Tatu Ylonen (SSH’s original author) secured port 22 from IANA in 1995, before SSH was open-sourced. The standard is port 22.
The ‘change to 2222’ argument
The argument for non-standard ports: most automated SSH scanners (mirai variants, brute-force bots) hit port 22 first. Moving to 2222 drops the noise in /var/log/auth.log from thousands of attempts per day to near-zero.
# /etc/ssh/sshd_config
Port 2222The team that does this also has to:
- Open port 2222 on the firewall (
ufw allow 2222/tcpor equivalent). - Update SSH config on every client that connects.
- Update any monitoring that checks the SSH port.
The friction is real but the noise reduction is also real. The team that runs a public-facing server and sees 50,000 auth attempts per day in their logs notices the difference.
The ‘just leave it’ argument
The argument for keeping 22: it is the default, every tool assumes it, every new developer on the team knows it, every monitoring check assumes it.
The team that keeps 22 handles the noise with fail2ban or rate-limiting, not by hiding. fail2ban drops connections from IPs that fail too many times, so the noise does not become a CPU cost.
# fail2ban sshd jail, /etc/fail2ban/jail.local
[sshd]
enabled = true
maxretry = 5
bantime = 3600The team that uses fail2ban (or a hosted equivalent) does not need to change the port - they handle the noise at the firewall level.
When the right answer is a non-standard port
Use a non-standard port when:
- The server is public-facing and sees a lot of bot traffic.
- The team is small enough that updating client config is one-time cost.
- Compliance requires the change (some PCI-DSS interpretations push for non-standard ports as defense-in-depth).
Do not change the port for:
- Internal-only servers (no bot traffic to filter).
- High-traffic SSH servers used by many clients (the friction outweighs the gain).
- Servers that need to be reachable by tools that assume port 22 (some CI systems, some monitoring).
Configuring multiple ports
SSH can listen on more than one port simultaneously:
# /etc/ssh/sshd_config
Port 22
Port 2222That keeps the default working for everyone, while exposing 2222 as a backup for the team’s bot-noise tools. sudo systemctl reload sshd activates both.
The team that does this temporarily during a port migration (22 to 2222) is doing it right: keep both ports open for the migration window, then drop 22 once the migration is complete.
How clients handle non-standard ports
Once the server is on 2222, clients need:
# Ad-hoc
ssh -p 2222 user@server
# Persistent (better)
# ~/.ssh/config
Host myserver
HostName server.example.com
Port 2222
User myuserThe config file is the right answer for any host the team uses regularly. The -p 2222 flag is the right answer for one-off connections. The team that uses SCP or rsync over SSH also needs the flag: scp -P 2222 file user@server: (note capital P for scp, lowercase p for ssh).
FAQ
Is port 22 secure?
The port number itself does not affect security - the authentication does. Port 22 with public-key auth is more secure than port 2222 with password auth. The team that focuses on auth method, not port number, has the right mental model.
Can I disable port 22 entirely?
Yes. Remove the Port 22 line from sshd_config and reload. The team that does this should keep a console session open (in case they lock themselves out) and have a documented recovery plan.
What port should I use instead of 22?
Any port not in use by another service, above 1024 so non-root cannot bind it (but sshd runs as root anyway, so this is more convention than security). 2222 is the most common alternative. 2022, 8022, and 22022 are also seen. Pick one and document it.
Does the firewall matter for SSH port changes?
Yes. Changing sshd_config does nothing if the firewall still blocks 2222. ufw allow 2222/tcp (Ubuntu) or firewall-cmd --add-port=2222/tcp --permanent (RHEL family) opens it. The team that forgets this sees their connection refused after the change.
Will fail2ban work on a non-standard port?
Yes - fail2ban parses log messages, not ports. The regex in the jail config matches on the log line, not the port. The team that changes ports and updates fail2ban config (some configs reference port 22 explicitly) is fine. The team that assumes fail2ban works without checking the config gets surprised.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: