SSH port
low on-server
What it inspects
The first `port` line of `sshd -T` output. It passes if sshd is on any port other than 22, and also passes on port 22 when the host is not publicly reachable. Otherwise it warns, with a very small score impact.
Why it matters
Moving SSH off port 22 cuts the volume of automated drive-by login attempts in your logs, but it does not stop a targeted attacker, who can port-scan. Treat it as optional noise reduction on top of key-only authentication, not a replacement for it. A mistake here can lock you out, so the change is a judgement call.
How to verify
sudo sshd -T | grep -i '^port 'How to fix
Optional. Open the new port in the firewall first, add it alongside 22, test a login, then remove port 22. Set Port in a 00- drop-in; on socket-activated Ubuntu run daemon-reload and restart ssh.socket.
Decide whether to change the port, and do it without locking yourself out needs your judgement
Any distro
# Optional. Changing the port is obscurity, not security; skip it if key-only auth is already in place.
# 1. Pick a free port (example 2222) and ALLOW IT IN THE FIREWALL FIRST, keeping port 22 open for now:
# ufw: ufw allow 2222/tcp
# firewalld: firewall-cmd --permanent --add-port=2222/tcp && firewall-cmd --reload
# Also open it in any cloud-provider security group.
# 2. RHEL family with SELinux enforcing: semanage port -a -t ssh_port_t -p tcp 2222
# (semanage comes from the policycoreutils-python-utils package).
# 3. Put the port in a drop-in that sorts first, /etc/ssh/sshd_config.d/00-umbermark-ssh_non_default_port.conf:
# Port 2222
# Port 22
# (keeping Port 22 for now; the check reads the first port of `sshd -T`, so 2222 is listed first).
# Then check it with `sshd -t`. If it fails, delete that file; do not reload.
# - Ubuntu 24.04 (and 23.04+) may start sshd from ssh.socket, whose generator reads Port from sshd_config at
# daemon-reload. Use the socket path only if `systemctl is-active --quiet ssh.socket` succeeds:
# if systemctl is-active --quiet ssh.socket; then sshd -t && systemctl daemon-reload && systemctl restart ssh.socket; fi
# (Ubuntu 22.10 only: there was no generator yet; set ListenStream in `systemctl edit ssh.socket`.)
# - Otherwise (ssh.socket not active): sshd -t && systemctl reload ssh (or `... reload sshd` on RHEL family).
# 4. From a SECOND session, confirm `ssh -p 2222 user@host` works.
# 5. Only then remove port 22 (the check reads the first `port` line of `sshd -T`, so 2222 must come first
# or 22 must be gone) and close port 22 in the firewall.