What Port is SSH: 22 (Default), How to Change, and Why

Q: Can sshd listen on multiple ports?

Yes - multiple `Port` lines in sshd_config. The team that uses this during port migration has both ports available.

SSH default port is 22, registered with IANA in 1995 by Tatu Ylonen (SSH’s original author) per the SSH.com history. The number 22 was chosen because it’s between 21 (FTP) and 23 (Telnet) - an unused port at the time. The team that uses port 22 has standard access. The team that changes to non-standard has security-through-obscurity.

Why 22
Verify port 22 is in use
Change the port
Connect to non-standard port
Security through obscurity
Multiple ports
FAQ

Why 22

Per SSH.com:

Tatu Ylonen, SSH’s creator, requested port 22 from IANA in 1995. The number 22 was chosen because:

It was unused at the time.
It sat between 21 (FTP) and 23 (Telnet) - secure shell between insecure protocols.
SSH’s author had a personal affinity for the number (some say he liked 22/22 puzzle patterns).

The team that knows the history has trivia for coffee breaks.

Verify port 22 is in use

sudo ss -tlnp | grep :22
# Or
netstat -tlnp | grep :22

The team that sees sshd listening on :22 has standard config.

Change the port

Edit /etc/ssh/sshd_config:

Port 2222

Restart:

sudo systemctl restart sshd

Update firewall:

sudo ufw allow 2222/tcp
sudo ufw deny 22/tcp

The team that changes the port updates both sshd_config AND the firewall.

Connect to non-standard port

ssh -p 2222 user@host
# Or in ~/.ssh/config:
Host myhost
    Port 2222
    User myuser

The team that uses -p 2222 or config has the right port.

Security through obscurity

Non-standard port reduces drive-by scans:

90%+ of automated attacks target port 22.
Moving to 2222 drops noise significantly.
Real protection is still: public-key auth, fail2ban, no root login.

The team that uses non-standard port has defense-in-depth, not primary security.

Multiple ports

sshd can listen on multiple ports:

Port 22
Port 2222

Useful for migration (keep 22 running while testing 2222). The team that runs multiple ports has flexibility.

FAQ

Is port 22 always the SSH port?

Default. The team that has not changed sshd_config has port 22. Changed config can have any port.

Can sshd listen on multiple ports?

Yes - multiple Port lines in sshd_config. The team that uses this during port migration has both ports available.

Why would I change the SSH port?

Reduce drive-by scan noise. The team that sees 50,000 failed login attempts per day on port 22 has motivation to change.

Does changing the SSH port break anything?

Only connection strings/scripts using port 22. The team that updates scripts and firewall rules has clean migration.

What’s the IANA port for SSH?

22, assigned in 1995.

If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.

Useful related references: