Port 22: SSH

What uses port 22

SSH (Secure Shell) encrypts everything, including authentication, which makes it the standard way to administer Linux and Unix servers. The same port also carries SFTP and SCP file transfers, port forwarding and git@github.com: style Git remotes. Because every server on the internet with port 22 open receives a steady stream of login attempts, how you configure authentication matters more than the port number.

Should port 22 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

• Use key-based authentication and set PasswordAuthentication no and PermitRootLogin no in /etc/ssh/sshd_config, then restart sshd.
• Moving SSH to another port only reduces log noise; it isn’t a security measure. Fail2ban or allowing only your IP or VPN does more.
• Connection refused means nothing listens on the port (sshd not running or wrong port); a timeout means a firewall drops the packets.

Check what is listening on port 22

sudo ss -ltnp 'sport = :22'

sudo lsof -nP -iTCP:22 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 22 -State Listen
netstat -ano | findstr :22

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 22

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:22 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 22 -State Listen).OwningProcess

Allow port 22 from trusted networks only

The examples allow 22 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 22 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 22 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="22" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "SSH 22/TCP" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 22 from another machine

nc -zv example.com 22

Test-NetConnection example.com -Port 22

Related ports

• Port 2222 (SSH (alternate)): a common alternate port for SSH.
• Port 23 (Telnet): used by Telnet, an old unencrypted remote terminal protocol.
• Port 3389 (RDP): used by RDP, Microsoft’s Remote Desktop Protocol.

More remote access ports

1194 (OpenVPN) , 5900 (VNC) , 5985 (WinRM (HTTP)) , 5986 (WinRM (HTTPS)) , 51820 (WireGuard) . See all ports in the port lookup.

Sources

• IANA port registry: 22

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions