4

I want to change my ssh port from 22 to something else. What is the port range I can change it to? Also, I don't want it to conflict with other apps that use common ports. What ports should I avoid?

4
  • 3
    I would not change any ports. Security by obscurity does not work. Or failing that, you would be better with port knocking Apr 30 '17 at 19:59
  • @RuiFRibeiro On my machines, I change the port just to stop the logs being cluttered by the port scanners' probing requests. It is a matter of convenience more than security. Port knocking is relatively hard to set-up.
    – Hermann
    Oct 18 '19 at 13:10
  • Have you tried fail2ban to automatically lock out any address that is a bit too aggressive?
    – xenoid
    Oct 18 '19 at 14:02
  • @Hermann Both at corporate level and at home, I always make a point of acessing SSH only over VPN. Oct 18 '19 at 14:29
0

You can check what local ports are in use currently to avoid a conflict with:

#netstat -taulpn
4

The other answers mistakenly seem to suggest that it is OK to use a service port which isn't used on your machine (as seen from the output of nmap localhost). It is not! This because:

  1. if you add that particular service later, it's going to conflict with the SSH server and you're going to be into trouble, and
  2. services that run on another registered service port are guaranteed to cause confusion.

For instance in Mohsen's output there is no service running on TCP port 143 so you might think that you could use that port for your SSH server. However, the day you also install a IMAP mailserver, it will conflict with it.

You should run SSH on an unprivileged port number, i.e. from 1024 to 65535, and avoid IANA registered service numbers (you can get the same list via the shell command cat /etc/services). It is usually also a good idea to choose a new port number that reminds the original port; for instance, in this case, 10022 or 22022.

6
  • 3
    I would add: Something NOT on this list: iana.org/assignments/service-names-port-numbers/…
    – Sobrique
    Apr 16 '15 at 9:28
  • Good point (although ports >= 1024 are lesser-known services which are less likely to conflict). Post edited.
    – dr_
    Apr 16 '15 at 9:38
  • 1
    there is a . dot at the end of the IANA url, so clicking on the link returns pages not found. Cannot edit the post because of minimum 6 characters for edit. :) Good answer have nothing else to add, just check the URL: iana.org/assignments/service-names-port-numbers/…
    – ionescu77
    Oct 17 '19 at 11:03
  • 1
    @ionescu77 Fixed the URL, thank you.
    – dr_
    Oct 18 '19 at 13:29
  • > a good idea to choose a new port number that reminds the original port; for instance, in this case, 10022 or 22022 But that would be the first ones check by hackers, wouldn't it?
    – xenoid
    Oct 18 '19 at 13:59
2

You can choose any other port to your liking, e.g. anything between 0 and 65535 (0 … 2¹⁶-1).

You can get the information for registered ports from /etc/services or something like wikipedia.

0

It's related to your machine, Suppose :

root@debian:/home/mohsen# nmap localhost 

Starting Nmap 6.47 ( http://nmap.org ) at 2015-04-16 04:57 IRDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000025s latency).
Other addresses for localhost (not scanned): 127.0.0.1
Not shown: 991 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
81/tcp   open  hosts2-ns
631/tcp  open  ipp
3306/tcp open  mysql
5432/tcp open  postgresql
9050/tcp open  tor-socks

If you want to change port 22 to 9050 , you have conflict.

Ports have been assigned by IANA you can view /etc/services by RFC6335

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.