Moving SSH to another port stops the automated scanners that only try 22. Your auth log gets quiet and the machine feels safer. The machine is not safer: anyone who scans the whole port range finds it in seconds, and that is what a targeted attempt does.

What actually protects the door

  • Keys instead of passwords - see SSH keys instead of passwords.
  • PasswordAuthentication no, so a guessed password is not a way in at all.
  • A firewall that only allows the addresses that need it.
  • Fail2ban for the rest - see what Fail2ban stops.

A different port is worth doing for the quieter logs. It is worth nothing on its own.

Change it without locking yourself out

  1. Open the new port in the firewall FIRST — sudo ufw allow 2222/tcp
  2. Add the port, keep 22 for now — two Port lines in /etc/ssh/sshd_config.
  3. Check the config parses — sudo sshd -t
  4. Reload, then open a NEW session on the new port — leave the old one connected until the new one works.
  5. Only then remove port 22 — and close it in the firewall.
# /etc/ssh/sshd_config\nPort 22\nPort 2222\n\nsudo sshd -t && sudo systemctl reload ssh
On RHEL, Alma and Rocky, SELinux blocks sshd from binding an unexpected port. Allow it first: sudo semanage port -a -t ssh_port_t -p tcp 2222. Without that the reload succeeds and the daemon still does not listen.

Tell your client

# ~/.ssh/config\nHost web1\n    HostName 203.0.113.10\n    Port 2222\n    User sara