Changing Your SSH Port with the Command Line

Firewalls have different ports that allow different services to access your server. There's a detailed explanation of firewalls and ports in Opening and Closing Firewall Ports. Certain services typically run on certain ports. For instance, Secure Shell (SSH) typically runs on port 22. But this predictability makes servers more vulnerable. Malicious programs and people can exploit common ports, especially if a server user has a weak password.

A quick and simple way to avoid some attackers is to change the port you use for SSH. This won't prevent attacks that are directed specifically at your server, but it will help if malicious programs are scanning port 22 for information: the information won't be there!

You change the SSH port via command line. The process involves

  1. Opening Your New Port in CSF
  2. Editing the SSH Configuration File
  3. Closing Port 22
  4. Reporting Your New SSH Port

If you've used a terminal to log into your server, you'll be able to change your SSH port.

Opening Your New Port in CSF

You must open your new firewall port before you edit your SSH configuration files. This ensures you aren't locked out of your server while you're making these changes. Follow these instructions for adding your new SSH port to your firewall. If you have a hardware firewall, please contact our Support team so we can make the changes to your hardware.

  1. Log into WHM. You can log into WHM from your account in the AlpineWeb Customer Backroom or by going to:

    https://www.my-web-site.com/whm

    Remember to replace https://www.my-web-site.com with your domain name.

  2. Locate ConfigServer Security & Firewall under Plugins in the left-hand navigation. Or, search for “Firewall” in the search bar. Then, click on ConfigServer Security & Firewall.

    csf home page


  3. Scroll down to csf – ConfigServer Firewall and click on Firewall Configuration. This page has all the settings for CSF. This is exactly the same file you'd see if you use the command line interface to edit this configuration file, but laid out graphically.

    firewall configuration

  4. Scroll down to IPv4 Port Settings.

  5. The important settings are TCP_IN and TCP_OUT.

    • Add your new SSH port number to TCP_IN to allow incoming traffic on that port.

    • Add your new SSH port number to TCP_OUT to allow outgoing traffic through that port.

    Separate ports with a comma, but don't use spaces.

    ivp4 ports

  6. Once you've added your port, scroll all the way to the bottom of the page and click Change.

  7. Your changes will be confirmed, and the last step is to restart your firewall to put your changes into action. Click Restart csf+ltd.

    restart csf and lfd

  8. CSF will restart and the changes you made will be live. You can click Return at the bottom of the page to go back to the main CSF configuration page.

Editing the SSH Configuration File

  1. SSH into your server. If you haven't SSH'd into your server before, read Logging into Your Server via Secure Shell (SSH) first.

  2. The SSH configuration file is called sshd_config and is located at:

    /etc/ssh/sshd_config

    Create a backup of this file by using the cp command to copy the file's contents into a new file. Type:
    cp /etc/ssh/ssh_config /etc/ssh/ssh_config_backup


    Check Your Work

    Look in the ssh directory to see if your backup file and your original file are both there:

    cd /etc/ssh


    then,

    ll

    You'll see both the sshd_config file and the sshd_config_backup

  3. Now that you have a backup file, you need to open the sshd_config file in a text editor. Let's use the Vim editor. Type:

    vim /etc/ssh/sshd_config
  4. You'll see the configuration file open on your screen. Using you keyboard's arrow keys, find the port setting. If your port is 22, the port setting will have a # at the beginning of the line. This turns the line into a comment: your server will ignore anything on that line.

    ssh port highlighted

  5. Press i to start inserting text. Then, remove the # in front of the port and change the number 22 to the port number you want to use for SSH.

    editing ssh port

    Choosing an SSH Port: Make sure you don't pick a port number that another service uses. Check Wikipedia's list of port numbers and their uses. Then, use a port number that isn't listed.

  6. When you're done editing your file, press the Esc key to stop inserting text, then type:

    :wq

    to write (save) your changes and quit the file.

  7. Now, you'll restart the SSH service. If you have a CentOS 7 server, use this command

    systemctl restart sshd

    and press Enter. If you have a server older than CentOS 7, use the command

    service sshd restart
    and press Enter.

Closing Port 22

You've successfully changed your SSH port! Now, you can safely close port 22 in your firewall. It's best practice to close ports you aren't using. Follow these instructions for adding your new SSH port to your firewall (Opening and Closing Firewall Ports). If you have a hardware firewall, please contact our Support team so we can make the changes to your hardware.

  1. Log into WHM. You can log into WHM through your account in the AlpineWeb Customer Backroom or by going to:

    https://www.my-web-site.com/whm


    Remember to replace https://www.my-web-site.com with your domain name.

  2. ConfigServer Security & Firewall is under Plugins in the left-hand navigation. Or, search for “Firewall” in the search bar. Then, click on ConfigServer Security & Firewall.

    csf home page


  3. Scroll down to csf – ConfigServer Firewall and click on Firewall Configuration. This page has all the settings for CSF. This is exactly the same file you'd see if you use the command line interface to edit this configuration file, but laid out grapically.

    firewall configuration

  4. Scroll down to IPv4 Port Settings.

  5. The important settings are TCP_IN and TCP_OUT.

    • Remove "22" from TCP_IN to deny incoming traffic on that port.

    • Remove "22" from TCP_OUT to deny outgoing traffic through that port.


    Separate ports with a comma, but don't use spaces.

    ivp4 ports

  6. Once you've removed port 22, scroll all the way to the bottom of the page and click Change.

  7. Your changes will be confirmed, and the last step is to restart your firewall to put your changes into action. Click Restart csf+ltd.

    restart lfd and csf

  8. CSF will restart and the changes you made will be live. You can click Return at the bottom of the page to go back to the main CSF configuration page.

Now, when you SSH into your server, you'll type in:

ssh [email protected] -p##

 

You'll replace "youripaddress" with your server's IP address and  "##" with your new SSH port. Logging in with:

 

ssh [email protected]

 

will no longer work. If you have any problems with your server, AlpineWeb will need your new SSH port to log into your server to help you.

Reporting Your New SSH Port

If you change your SSH port, log into your AlpineWeb account and securely tell AlpineWeb your new SSH port.

  1. Log into your AlpineWeb account in the

    AlpineWeb Customer Backroom

  2. Once logged in, click on the Manage Account Details.

  3. Next, scroll down and locate the SSH Port field.

  4. Then, type in your new SSH port into the SSH Port field.

  5. Click Save Settings.

AlpineWeb takes your security very seriously. We only log into your server when you need help and we've authenticated your identity.

  • CSF, Firewall, Ports, SSH
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

Brute Force Detection (BFD)

Brute Force Detection(BFD) is a critically important part of protecting your server from...

Logging Into Your Server via Secure Shell (SSH)

If you're comfortable using WHM and cPanel, you might be ready to use a command line interface...

WHM Getting Started Guide

Control your server without being a command line guru with WHM. Even if you only host one website...

Configuring cPanel Backups in WHM

You've spent a lot of time creating your website: what if something goes wrong? From a malicious...

Opening and Closing Firewall Ports

Every server at AlpineWeb has at least one software firewall to protect your server from...