How to Change the SSH Port on Proxmox VE Safely

Before You Begin

• Confirm your Proxmox VE version and whether the host is standalone or clustered.
• Ensure you have root or equivalent administrative access.
• Keep a working console, IPMI, iDRAC, iLO, or another out-of-band recovery option available.
• Identify every firewall between your workstation and the Proxmox management interface.
• Check whether monitoring tools, Ansible, backup jobs, scripts, or other nodes connect to this host over SSH.
• Choose an approved unused TCP port. This guide uses 2222.

Before editing anything, check the current listener and service:

On Debian-based Proxmox VE systems, the OpenSSH service is commonly managed as ssh, while the daemon itself is sshd. The commands below use the standard Proxmox VE service name.

Step 1: Back Up and Edit the SSH Daemon Configuration

OpenSSH reads its server settings from /etc/ssh/sshd_config. The Port directive specifies the TCP port on which the daemon listens. The default is 22.

Back up the existing configuration

Run these commands from your existing SSH session or the host console:

This gives you a copy to restore if the new configuration prevents SSH from starting.

Set the new port

Edit the configuration file:

Find the existing Port line. It may be commented out:

Set one active port directive:

Check for other active Port directives and review any included configuration files before saving. OpenSSH can accept multiple port directives, so leaving an old active directive may mean the daemon continues listening on port 22. For a straightforward port change, configure only the intended port.

Validate before restarting

Run the syntax check:

If the command returns no output and exits successfully, the configuration passes the basic syntax check. If it reports an error, correct it before restarting the service.

For the directive’s exact behavior, consult the OpenSSH sshd_config(5) manual.

Will Changing SSH Affect the Proxmox Web UI or Cluster?

The Proxmox web interface normally listens on HTTPS port 8006. Changing the OpenSSH listening port does not, by itself, change that web-interface port. You should still be able to access the UI at:

However, the distinction between the web interface and cluster dependencies matters:

• Web UI: Its HTTPS listener is separate from the OpenSSH port.
• Cluster communication: Corosync uses its own network ports, but Proxmox documentation also identifies SSH on TCP 22 between nodes for cluster-related operations.
• Migration and automation: Workflows that invoke SSH may assume the default port.

For release-specific details, consult the official Proxmox VE documentation.

Step 2: Update Firewall Rules

The new port must be permitted at every firewall between the SSH client and the Proxmox host. Changing sshd_config does not create firewall rules automatically.

Check the Proxmox VE firewall

If you use the Proxmox firewall, review the configuration in the web UI at the datacenter and node levels. Confirm which rules apply to the host and whether the firewall is enabled. Add an inbound TCP rule for port 2222, limited to your trusted management IP or subnet where possible.

Typical places to review include:

• Datacenter level: Rules that apply across the cluster.
• Node level: Rules specific to the Proxmox host.
• VM/CT level: These govern guest traffic and are generally not the place to permit access to the host’s own SSH daemon.

Rule precedence and firewall behavior depend on your Proxmox VE version and configuration. Confirm the effective policy rather than adding a broad allow rule without checking existing restrictions.

Check the host and upstream firewalls

If you manage the host with additional firewall software, inspect that configuration too. For example, if UFW is installed and actively used:

Replace 192.168.1.0/24 with your trusted management subnet. Do not enable UFW just to run this example if another firewall system already manages the host.

Also review upstream routers, hardware firewalls, VPN policies, and cloud security controls where applicable. Do not expose the new SSH port to the internet unless your security design explicitly requires it.

Step 3: Restart SSH Safely

After validating the configuration and updating the firewall, reload the SSH service:

Check the service status:

Verify that a listener exists on the new port:

Keep your original session open. Restarting the service does not necessarily terminate an established SSH connection, but that existing connection is not proof that new connections will work. If the daemon fails to start or the firewall blocks the new port, closing your current session could remove your only remote access path.

Step 4: Test the New Port From a Second Session

Open a new terminal on your workstation. Do not reuse the existing session for this test.

Connect with the SSH command

Replace the example address with your Proxmox management IP. If you use a non-root account, specify that account instead.

Test TCP connectivity separately

From a Linux workstation, you can check whether the port is reachable:

A successful TCP connection does not guarantee that authentication will succeed, but it helps distinguish network problems from account or key problems.

Step 5: Update SSH Client Configuration and Scripts

Typing -p 2222 every time works, but an SSH client configuration entry is easier to maintain. On your workstation, edit ~/.ssh/config:

Replace the hostname, address, account, and key path with your own values. You can then connect with:

Review scripts and tools that connect to the host, including Ansible inventories, shell scripts, monitoring systems, backup automation, deployment pipelines, and SSH-based management tools. Update the port wherever the old default was explicitly configured.

For client-side configuration precedence and the Port option, see the OpenSSH ssh_config(5) manual.

Troubleshooting and Lockout Recovery

How to recover if you lose SSH access

Use the Proxmox host console, physical access, or configured out-of-band management. Do not rely on the web UI as a guaranteed way to repair a broken host SSH configuration.

1. Log in through the console with an administrative account.
2. Check whether the service is running: systemctl status ssh --no-pager.
3. Validate the configuration: sshd -t.
4. Inspect active listeners: ss -lntp.
5. Restore the backed-up configuration if necessary. Use the actual backup filename created earlier.
6. Run sshd -t again, then restart with systemctl restart ssh.
7. Restore or correct the firewall rules, and test a new SSH connection.

To restore a specific backup, use its exact filename rather than a wildcard:

Replace the sample backup filename with the real one on your host. Restoring the original file may return SSH to port 22, so ensure the corresponding firewall rule is available before ending console access.

Security Considerations

• Restrict source addresses: Permit SSH from trusted administration networks or a VPN rather than from every source.
• Use key-based authentication: Protect private keys and remove access for users who no longer need it.
• Keep Proxmox VE updated: Apply supported security updates and monitor advisories.
• Preserve cluster compatibility: Verify internal SSH requirements before changing the default port on a cluster node.
• Review logs: Investigate unexpected login attempts and authentication failures.
• Maintain console recovery: Test your recovery path before making remote access changes.

Changing the port can reduce routine connection noise, but it does not replace authentication hardening or network restrictions. For the next step, follow the VMoreCloud guide on hardening SSH by disabling root and password login. Apply those settings carefully, ensuring that a working administrative account and key are available before restricting root access.

If you also run container workloads on your virtualization platform, see the VMoreCloud article about Proxmox and OCI containers.

Official References

• Proxmox VE official documentation
• Proxmox VE Administration Guide
• OpenSSH sshd_config(5) manual
• OpenSSH ssh_config(5) manual
• OpenSSH sshd(8) manual

Conclusion

To change the SSH port on Proxmox VE safely, back up sshd_config, set the new port, validate it, update the relevant firewall rules, restart SSH, and confirm access from a second session. Keep your original session and a console recovery option available until the test succeeds.

Recommended next step: Once access is stable, harden your SSH configuration using the VMoreCloud SSH security guide. If your host belongs to a cluster, verify all node-to-node SSH dependencies before removing port 22.