SSH Server On Alternative Port

Having your SSH server easily visible to the outside world, is never a good idea. The ideal solution, is to firewall off access to the SSH port (22) and provide access only to IPs that should have administrative access to your server. Unfortunately, this is not always possible; either because of dynamic client IPs, or large variety of users requiring access.

The easiest way to secure access to your server without a Firewall acl or a VPN, is to change the port SSH listens on.

Updating sshd_config

Firstly, you'll need to login to your server via SSH. To update the SSH server listening port, we simply need to edit the file /etc/ssh/sshd_config using any text editor; such a vim or nano.

On approximately line 13, you'll see the following line that defines the port, which is commented out.

#Port 22

To customize this setting, simply delete the leading '#', and update the value from '22' to your own value. This can be set to any desired port between 1 and 65535. You will need to be sure to set this to a port that is not already in use (such as 80 and 443, which are used by Apache). You can view this fairly complete list of common (and uncommon) TCP ports and the services that use them. In general, it's best to set this to a port above 1023.

Apply and Use

Once sshd_config is updated and save, all that is required now is to restart the SSH server:

/etc/init.d/sshd restart

SSH will now be listening on your newly set port. From this point on, you'll need to update the 'Port' value in putty, or use the '-p' switch with 'ssh', to connect.