Thorn Tech Marketing Ad
Skip to main content
Version: Next

Changing the Default SSH Port

TLDR

Purpose: Move the VM's OpenSSH service from the default port 22 to a custom port

Config File: In /etc/ssh/sshd_config, change Port 22 to your port, for example Port 2222

Apply It:

  • AWS (Amazon Linux 2023): sudo systemctl restart sshd
  • Azure and Google Cloud (Ubuntu 24.04): sudo systemctl daemon-reload && sudo systemctl restart ssh.socket

Important: Allow the new port in your firewall first, and keep your current session open until a new connection on the new port works

Product: StorageLink by Thorn Technologies — cloud storage gateway for secure file sharing

Overview​

The OpenSSH service for StorageLink listens on port 22 by default. Some organizations prefer to move it to a different port. This article shows how to do that, and how to confirm the change took effect before you disconnect.

Azure and Google Cloud (Ubuntu 24.04)

On the Azure and Google Cloud images, SSH is socket-activated: systemd, not the SSH service, listens on the port. Restarting the SSH service alone leaves SSH on the old port and moves it only at the next reboot, which can lock you out later if your firewall is not ready for it. Use the Azure or Google Cloud steps below, which reload the socket.

Changing the SSH Port​

Step 1: Allow the new port in your firewall. Before you change anything, add an inbound rule for the new port (for example TCP 2222 from your IP address) to the VM's security group on AWS, network security group on Azure, or firewall rules on Google Cloud. Keep the rule for port 22 until you have confirmed that the new port works. See Security Group Configuration.

Step 2: Edit the SSH configuration. SSH into your VM and open the configuration file as root (see Editing Files on Linux if you are new to the terminal editors):

sudo vi /etc/ssh/sshd_config

Change this line:

Port 22

To your new port, for example:

Port 2222

Step 3: Apply the change.

sudo systemctl restart sshd

Step 4: Confirm before you disconnect. Check that SSH now listens on the new port:

sudo ss -tlnp | grep ':2222 '

Then, without closing your current session, open a second terminal and connect on the new port:

ssh -i private.key -p 2222 <user>@<ip-address>

Once the new connection works, you can remove the firewall rule for port 22.

note

The OS Patching script reads the SSH port from your configuration and checks that SSH is listening on it, so a custom port is supported. If the configured port and the port SSH is actually listening on disagree — for example because step 3 was skipped — the script refuses to patch until you fix it.