Learn how to connect to a server that runs SSH on a custom port, save the port in your SSH config, and change the SSH port on the server without locking yourself out.
-p option followed by the port number: ssh -p 2222 user@server-ip. For scp and sftp, use an uppercase -P. To change the port on the server, edit the Port line in /etc/ssh/sshd_config, allow the new port in the firewall and restart the SSH service.Connect to Any SSH Port and Change Yours Safely
SSH listens on port 22 by default, but many servers use another port to cut down on automated login attempts. This guide covers both sides: connecting to a custom port, and moving your own server to one.
Connect with -p
Specify the port with ssh -p, or scp -P for file copies.
Save It Once
Store the port in ~/.ssh/config and stop typing it.
Change It Safely
Edit sshd_config, open the firewall and test before closing port 22.
Connect to SSH on a Different Port
If a server does not use port 22, the default SSH client will fail with a “connection refused” or timeout message. Tell the client which port to use with the -p option.
SSH with the -p option
ssh -p 2222 user@192.168.1.10Replace 2222 with the real port, user with your account and the address with your server’s IP or hostname.
Use the URL format (alternative)
ssh ssh://user@192.168.1.10:2222Other tools use a different option
The port option is not the same for every command. Remember that ssh uses lowercase -p, while scp and sftp use uppercase -P.
| Tool | Example |
|---|---|
| ssh | ssh -p 2222 user@server |
| scp (copy a file) | scp -P 2222 file.txt user@server:/tmp/ |
| sftp | sftp -P 2222 user@server |
| rsync | rsync -avz -e "ssh -p 2222" ./folder user@server:/backup/ |
| ssh-copy-id | ssh-copy-id -p 2222 user@server |
Save the Port in ~/.ssh/config
Typing the port every time is easy to forget. Add a host entry to your SSH client configuration instead.
Edit your SSH config file
nano ~/.ssh/configAdd an entry like this:
Host myserver
HostName 192.168.1.10
User khurram
Port 2222Now connect with just the alias:
ssh myserverThe same alias also works with scp, sftp and rsync, so you no longer need -p or -P. If the file is new, make sure its permissions are strict: chmod 600 ~/.ssh/config.
Change the SSH Port on Your Server
These steps are for the server that you administer. Work from a console or a second open session, so you can fix mistakes.
Choose a port and back up the config
Pick an unused port above 1024 that no other service uses, such as 2222. Then back up the SSH daemon configuration:
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bakEdit sshd_config
sudo nano /etc/ssh/sshd_configFind the line #Port 22, remove the # and set the new port:
Port 2222To keep port 22 working while you test, you can temporarily list both ports on two lines: Port 22 and Port 2222. Some distributions also load extra files from /etc/ssh/sshd_config.d/, so check that no file there overrides your port.
Validate the configuration
sudo sshd -tNo output means the file has no syntax errors.
Open the new port in the firewall
Allow the new port before you restart SSH:
# Ubuntu / Debian with UFW
sudo ufw allow 2222/tcp
# RHEL / Rocky / AlmaLinux with firewalld
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reloadOn a cloud VM, also open the port in the provider’s network rules, such as an AWS security group or an Azure network security group.
Allow the port in SELinux (RHEL-based systems)
If SELinux is enforcing, label the new port as an SSH port:
sudo semanage port -a -t ssh_port_t -p tcp 2222If semanage is missing, install the policycoreutils-python-utils package first.
Restart the SSH service
# Debian / Ubuntu
sudo systemctl restart ssh
# RHEL / Rocky / AlmaLinux / Fedora
sudo systemctl restart sshdsystemctl status ssh.socket. Then either override the socket port with sudo systemctl edit ssh.socket and add:
[Socket]
ListenStream=
ListenStream=2222sudo systemctl daemon-reload && sudo systemctl restart ssh.socket, or disable socket activation with sudo systemctl disable --now ssh.socket and sudo systemctl enable --now ssh.Test from a second terminal
ssh -p 2222 user@server-ipOnly after this works should you close your original session. Once you are sure, remove Port 22 from the config and close port 22 in the firewall.
Verify the New Port
Confirm that the SSH daemon is listening on the right port:
sudo ss -tlnp | grep sshdYou should see a line that ends in :2222. You can also test the port from another machine:
nc -vz server-ip 2222SSH on a Different Port in Windows
Windows as the SSH client
The OpenSSH client in Windows 10, Windows 11 and Windows Server uses the same option in PowerShell or Command Prompt:
ssh -p 2222 user@server-ipIn PuTTY, type the new port in the Port field on the Session screen before you click Open.
Windows as the SSH server
If you run the OpenSSH Server on Windows Server, edit C:\ProgramData\ssh\sshd_config and set Port 2222. Then add a firewall rule and restart the service from an elevated PowerShell window:
New-NetFirewallRule -Name "sshd-2222" -DisplayName "OpenSSH Server (2222)" -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 2222
Restart-Service sshdSee Microsoft’s OpenSSH server configuration page for details.
Security Best Practices
Changing the port only hides SSH from simple scans. A determined attacker can still find it, so treat it as a small extra, not as your main protection.
- Use key-based authentication and disable password logins with
PasswordAuthentication no - Disable direct root login with
PermitRootLogin no - Limit who can connect with
AllowUsersor a firewall rule for your own IP range - Install fail2ban or a similar tool to block repeated failed logins, and set it to watch the new port
- Keep OpenSSH and the operating system updated
- Monitor which devices are on your network. See our guide to installing NetAlertX with Docker on Linux
Troubleshooting
Connection refused
Nothing is listening on that port. Check sudo ss -tlnp | grep sshd, confirm the service restarted and look at sudo systemctl status ssh.
Connection timed out
A firewall or cloud security group is probably blocking the port. Open it on both the host and the provider network.
Still listening on port 22
Check for an override in /etc/ssh/sshd_config.d/ and for ssh.socket on Ubuntu, as explained in Step 6.
Works on the LAN but not remotely
Forward the new port on your router, or open it in the external firewall.
Permission denied (publickey)
The port is fine, so check your key, file permissions and the authorized_keys file on the server.
Locked out after the change
Use the VM console, a cloud serial console or physical access to restore /etc/ssh/sshd_config.bak, then restart SSH.
For more detail, see the official manual pages for ssh_config and sshd_config.
Frequently Asked Questions
How do I SSH with a different port?
Use the -p option: ssh -p 2222 user@server-ip. Replace 2222 with the port that the SSH server listens on.
What is the difference between ssh -p and scp -P?
The ssh command uses a lowercase -p, while scp and sftp use an uppercase -P for the port.
How do I save a custom SSH port so I do not type it every time?
Add a Host entry with a Port line to the ~/.ssh/config file, then connect with ssh and the host alias.
How do I change the SSH port on the server?
Edit the Port line in /etc/ssh/sshd_config, open the new port in the firewall, restart the SSH service and test the new port before you close your current session.
Is changing the SSH port more secure?
It reduces automated scan noise, but it is not real security. Use key-based authentication, disable password and root login and add a tool such as fail2ban.
Which port number should I choose?
Choose an unused port above 1024 that is not used by another service. Many admins use values such as 2222, and avoid ports in the 32768 to 60999 range that Linux uses for outgoing connections.
Conclusion
To SSH with a different port, add -p to your command, or save the port once in ~/.ssh/config. To move your own server to a custom port, edit sshd_config, open the new port in the firewall, restart SSH and test from a second session before you close the old one. Pair the change with key authentication and fail2ban so that the port change is only one layer of a stronger setup.
Port 2222 → sudo sshd -t → Open the firewall → Restart SSH → Test ssh -p 2222 in a new terminal → Close port 22.Keep Learning with VMoreCloud
Find more step-by-step tutorials on Linux, networking, Windows Server, Azure and virtualization.
Sources & Further Reading
Technical note: service names, firewall tools and default settings differ between distributions and versions. Test changes on a non-production server or keep console access available, and only change settings on systems that you are authorized to administer.