Changing SSH Port on Linux VPS: A Step-by-Step Guide

Understanding SSH and Its Importance

Secure Shell (SSH) is a cryptographic network protocol used to operate network services securely over an unsecured network. Its primary purpose is to provide secure access to a remote system, allowing users to perform operations as if they were physically present at the terminal. SSH is widely used for managing servers, transferring files, and executing commands securely.

This article is part of Rackset’s Server guides — browse the rest of the category for more in-depth tutorials on this topic.

Why Is SSH Important?

SSH is crucial for several reasons:

• Security: SSH encrypts the data exchanged between the client and server, protecting it from eavesdropping, man-in-the-middle attacks, and other forms of cyber threats.
• Authentication: It supports various authentication mechanisms, including password-based and public key authentication, enhancing the security of server access.
• Data Integrity: SSH ensures that the data sent over the network is not altered during transit, maintaining its integrity.
• Port Forwarding: It allows secure tunneling of other protocols, providing a secure way to access network services.

Default SSH Port and Security Implications

The default port for SSH communication is port 22. This is widely known, making it a common target for automated attacks and port scanning tools such as Netcat, Nmap, and Telnet. These tools can easily identify open ports and the services running on them, posing a security risk if appropriate measures are not taken.

Although social engineering is increasingly used for sophisticated cyberattacks, many attacks still rely on automated scripts that exploit common configuration errors and insecure default settings. Leaving the SSH port at its default setting is one such vulnerability.

Benefits of Changing the Default SSH Port

Changing the default SSH port on your Linux VPS can offer several advantages:

1. Reduced Visibility: By using a non-standard port, you make it less likely for automated scripts to discover your SSH service, reducing exposure to basic attacks.
2. Additional Layer of Security: While not foolproof, altering the default port adds an extra hurdle for attackers, complementing other security measures.

In the subsequent sections of this guide, we will walk you through the process of changing the SSH port on your Linux VPS to enhance your server’s security.

Default SSH Port and Its Vulnerabilities

The Secure Shell (SSH) protocol is a critical component for managing and accessing your Linux VPS remotely. By default, SSH listens on port 22, which is well-known and universally recognized. This default setting, while convenient, poses certain security risks primarily due to its predictability.

Understanding the Default SSH Port

SSH communication typically occurs over port 22. This port is designated for SSH traffic, allowing users to securely log into remote systems and execute commands. However, its default nature makes it a common target for attackers.

Vulnerabilities of Using Port 22

• Port Scanning: Have you ever attempted basic port scanning services using tools like Netcat, Nmap, and Telnet on your local network or server? These tools make it simple to discover open ports, including port 22, and the services running on them. Attackers frequently use these tools to identify potential targets.
• Automated Attacks: Many cyber-attacks are automated, leveraging scripts that scan for systems with default configurations. Port 22 is often targeted by these scripts because it is the default SSH port.
• Brute Force Attacks: Once port 22 is identified as open, attackers may attempt brute force attacks to gain unauthorized access. These attacks involve systematically guessing passwords to break into the system.

Why Change the Default SSH Port?

Changing the default SSH port to a non-standard port can significantly reduce the risk of these automated attacks. By doing so, you shield your server from less sophisticated attacks that primarily target systems with default settings. While this is not a foolproof security measure, it adds an additional layer of obscurity that can deter automated scripts.

Additional Security Measures

Alongside changing the SSH port, consider implementing other security measures such as:

1. Using SSH keys: These provide a more secure authentication method than passwords.
2. Implementing a firewall: Restrict access to the SSH port using firewall rules.
3. Intrusion Detection Systems: Deploy systems to monitor and alert you of any suspicious activity.

By understanding the vulnerabilities associated with the default SSH port and taking proactive steps to mitigate these risks, you can enhance the security of your Linux VPS.

Benefits of Changing the SSH Port

Changing the SSH port from its default setting of 22 to a custom port number can provide several security advantages. While it is not a comprehensive security measure on its own, it serves as an essential component of a broader security strategy for your Linux VPS. Below are some key benefits of changing the SSH port:

Reduce Exposure to Automated Attacks

Many automated scripts and malware are designed to target systems with default configurations, including SSH running on port 22. By changing the SSH port to a non-standard number, you significantly reduce the risk of these automated attacks succeeding. This simple step can act as a deterrent, forcing attackers to exert more effort to find your SSH service.

Minimize Port Scanning Visibility

Port scanning tools like Netcat, Nmap, and Telnet are commonly used to identify open ports and associated services on a network. By moving SSH to a non-standard port, you make it less likely for casual port scans to detect your SSH service. This reduces the chances of your server being targeted by opportunistic attackers.

Decrease the Likelihood of Brute Force Attacks

Brute force attacks often focus on services running on default ports. By changing the SSH port, you can decrease the likelihood of such attacks. While this doesn’t eliminate the possibility of brute force attempts, it adds an additional layer of obscurity, making it harder for attackers to find and target your service.

Read more: How to Change Passwords in Linux VPS Server

If you need this service, Rackset’s team provides professional Linux VPS with full support so you can rely on the quality and get set up quickly.

Improved Security Through Obscurity

While security through obscurity should not be the sole defense mechanism, it does add an extra hurdle for attackers. Changing the SSH port number contributes to a layered security approach, making it more challenging for attackers to gain unauthorized access to your server.

Custom Configuration Flexibility

Changing your SSH port allows for greater flexibility in configuring your server’s network settings. You can choose a port that aligns with your organization’s security policies or network architecture, providing a more tailored security solution.

Summary

Incorporating a custom SSH port into your security strategy can enhance your server’s defenses against common, unsophisticated attacks. While it is not a standalone solution, it complements other security measures, such as firewalls and intrusion detection systems, to create a more secure environment.

Preparing Your Linux VPS for SSH Port Change

Before changing the SSH port on your Linux VPS, it’s crucial to prepare your server to ensure a smooth transition and avoid potential lockouts. This preparation involves several key steps that safeguard your server’s accessibility and security.

1. Verify Root Access

Ensure you have root or superuser access to your Linux VPS. Without this level of access, you won’t be able to modify the SSH configuration file, which is necessary for changing the port.

2. Update Your System

Before making any changes, update your system to ensure all software packages are current. This can help prevent compatibility issues and improve security.

sudo apt update && sudo apt upgrade -y

3. Backup Configuration Files

Always back up your current SSH configuration file before making any changes. This allows you to restore the original settings if needed.

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

4. Configure Firewall Rules

Adjust your firewall settings to allow traffic on the new SSH port. This step is crucial to prevent being locked out of your server after the port change.

Using UFW (Uncomplicated Firewall)

# Replace 'NEW_PORT' with your desired port number
sudo ufw allow NEW_PORT/tcp

Using iptables

# Replace 'NEW_PORT' with your desired port number
sudo iptables -A INPUT -p tcp --dport NEW_PORT -j ACCEPT

5. Test Current SSH Configuration

Before making changes, test your current SSH setup to ensure it is functioning correctly. This helps identify any existing issues that could complicate the port change process.

ssh -p 22 your_username@your_server_ip

6. Plan for a Rollback

Have a rollback plan in place. This includes knowing how to access your server via an alternative method, such as a web-based console provided by your hosting provider, in case the SSH connection fails after the port change.

By following these preparatory steps, you can minimize the risk of connectivity issues and ensure a successful SSH port change on your Linux VPS.

Steps to Change the SSH Port on Linux VPS

Changing the SSH port on your Linux VPS can help protect your server from automated attacks targeting the default SSH port (22). Here’s a step-by-step guide to help you change the SSH port safely:

Step 1: Backup the SSH Configuration File

Before making any changes, it’s crucial to back up your current SSH configuration file. This ensures you can revert if something goes wrong.

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Step 2: Choose a New Port Number

Select a new port number between 1024 and 65535, as ports below 1024 are reserved for well-known services. Avoid using ports commonly used by other services.

Read more: Accessing Linux Servers from macOS via SSH

For projects that need guaranteed resources and full root control, a VPS is the right step up from shared hosting. With VPS hosting you get dedicated CPU/RAM, NVMe storage, a dedicated IP and high uptime, deployed in minutes.

Step 3: Edit the SSH Configuration File

Open the SSH configuration file using your preferred text editor. Here, we use nano:

sudo nano /etc/ssh/sshd_config

Find the line that specifies the port. It usually looks like:

#Port 22

Uncomment the line by removing the # and change 22 to your new port number:

Port 2222

Step 4: Update Firewall Rules

Adjust your firewall settings to allow traffic on the new SSH port. If you’re using ufw, you can update the rules as follows:

sudo ufw allow 2222/tcp
sudo ufw delete allow 22/tcp

Step 5: Restart the SSH Service

After saving your changes, restart the SSH service to apply the new settings:

sudo systemctl restart sshd

Step 6: Test the New SSH Port

Open a new terminal session and attempt to connect to your server using the new port:

ssh -p 2222 username@your-server-ip

If you can connect successfully, the port change was successful. If not, check your settings and firewall rules for any mistakes.

Step 7: Update Any Automation Scripts

If you use scripts or applications that connect to your server via SSH, ensure they are updated to use the new port number.

By following these steps, you can change the SSH port on your Linux VPS, enhancing its security against automated attacks targeting default configurations.

Testing the New SSH Port Configuration

After changing the SSH port on your Linux VPS, it’s crucial to test the new configuration to ensure that you can still connect to your server and that the changes have been correctly applied. Follow these steps to verify your new SSH port setup:

Verify SSH Daemon Status

Before testing the connection, ensure that the SSH service is running smoothly. You can check the status of the SSH daemon using the following command:

sudo systemctl status sshd

If the service is active, you should see output indicating that the SSH daemon is running. If not, you may need to restart the service:

sudo systemctl restart sshd

Connect Using the New SSH Port

To test the new SSH port, attempt to connect to your server using an SSH client. Replace new_port_number with the port number you configured:

Read more: How to Change Remote Desktop Port

ssh username@your_server_ip -p new_port_number

If the connection is successful, it confirms that the SSH daemon is accepting connections on the new port.

Test with Port Scanning Tools

Utilize port scanning tools such as Netcat, Nmap, or Telnet to ensure that the new SSH port is open and accessible:

For heavy workloads and maximum performance, a dedicated bare-metal server gives you an entire physical machine. Rackset’s dedicated server deliver full hardware, root access and configurable port speeds for the most demanding sites and apps.

Using Nmap

nmap -p new_port_number your_server_ip

The output should indicate that the new port is open. If it shows as closed or filtered, verify your firewall settings.

Using Netcat

nc -zv your_server_ip new_port_number

A successful connection message confirms that the port is open.

Using Telnet

telnet your_server_ip new_port_number

If connected, you’ll see a message indicating a successful connection. If the connection fails, double-check your configurations.

Update Firewall Rules

Ensure that your firewall settings allow traffic on the new SSH port. For example, if you’re using UFW, execute:

sudo ufw allow new_port_number/tcp

Then, reload the firewall to apply the changes:

sudo ufw reload

After confirming the new port configuration and updating your firewall rules, your server should be more secure against basic automated attacks targeting the default SSH port.

Additional Security Measures After Changing SSH Port

Changing the SSH port on your Linux VPS is a significant step in enhancing your server’s security. However, it should not be the only measure you take. Here are additional security practices to implement after changing your SSH port:

1. Use Strong Authentication Methods

• Disable Password Authentication: Opt for SSH key-based authentication, which is more secure than using passwords. Generate a key pair with the following command:

  ssh-keygen -t rsa -b 4096

  Copy the public key to your server:

  ssh-copy-id user@your-server-ip

• Enable Two-Factor Authentication (2FA): Add an extra layer of security by using 2FA. Tools like Google Authenticator can be integrated with SSH to require a time-based one-time password (TOTP).

2. Configure a Firewall

Implement a firewall to allow only necessary traffic to your server. For example, using ufw (Uncomplicated Firewall) on Ubuntu, you can allow the new SSH port and deny others:

sudo ufw allow 1234/tcp  # Replace 1234 with your new SSH port
sudo ufw enable

3. Implement Intrusion Detection Systems

• Fail2ban: This tool monitors log files and bans IPs that show malicious signs, such as too many password failures. Install and configure it with:

  
  sudo apt-get install fail2ban
  sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
          

  Edit the jail.local file to protect your SSH service:

  
  [sshd]
  enabled = true
  port = 1234  # Replace 1234 with your new SSH port
          

4. Regularly Update Your System

Keep your server’s software and packages up to date to protect against vulnerabilities. Use the following commands to update your system:

sudo apt-get update
sudo apt-get upgrade

5. Monitor and Log Access

Regularly review your SSH logs to monitor for unauthorized access attempts. Use the following command to view the SSH log:

sudo cat /var/log/auth.log | grep "sshd"

By implementing these additional security measures, you can significantly reduce the risk of unauthorized access to your Linux VPS.

Conclusion

Changing the default SSH port on your Linux VPS is a straightforward yet effective way to enhance the security of your server. By following the steps outlined in this guide, you can reduce the risk of automated attacks and unauthorized access attempts. Remember to choose a port number that is not commonly used by other services, and ensure that your firewall settings are updated accordingly to allow connections on the new port.

As you continue to manage and secure your server, consider exploring other security measures such as implementing SSH key authentication and regularly updating your software packages. If you’re ready to take your server management to the next level, Rackset offers a range of hosting solutions and expert support to help you achieve your goals. Visit our website today to learn more about our services and how we can assist you in maintaining a secure and efficient server environment.

Frequently Asked Questions

Why should I change the default SSH port on my Linux VPS?

Changing the default SSH port from 22 to another number can help reduce the risk of automated attacks and unauthorized access attempts. It adds an extra layer of security by making it less obvious for attackers to locate your SSH service.

How do I change the SSH port on my Linux VPS?

Edit the SSH configuration file located at /etc/ssh/sshd_config. Locate the line that starts with ‘Port’ and change the number to your desired port. Save the file and restart the SSH service using ‘systemctl restart sshd’ or ‘service sshd restart’.

What should I do if I accidentally lock myself out after changing the SSH port?

If you lock yourself out, you can try accessing your VPS through a web-based console provided by your hosting provider. This allows you to revert the changes or correct the configuration file to regain access.

Are there any ports I should avoid when changing the SSH port?

Yes, avoid using ports that are commonly used by other services, such as 80, 443, and 3306. It’s best to choose a port number between 1024 and 65535 that is not already in use.

Is changing the SSH port alone enough to secure my Linux VPS?

No, changing the SSH port is just one part of securing your VPS. You should also implement other security measures such as using strong passwords, enabling firewalls, and configuring fail2ban to protect against brute-force attacks.

Tags : buy linux VPS hosting change ssh port change ssh port number change ssh port on linux default ssh port linux change ssh port Linux VPS hosting