Overview
Most automated attacks target SSH on port 22 and the root account. Changing the port and disabling direct root login reduces noise and risk. This article shows how to do both safely without locking yourself out.
Before you begin
- A working non-root sudo user with SSH key access.
- Your current SSH session kept open until you have verified the new settings.
- Console access via the ALYPOD Console as a safety net.
Steps
1. Create a sudo user first
Never disable root before you have another way in:
bash
adduser deploy
usermod -aG sudo deploy # Debian/Ubuntu
usermod -aG wheel deploy # RHEL family
Confirm you can log in as deploy with your key.
2. Edit the SSH configuration
bash
sudo nano /etc/ssh/sshd_config
Set (or add) these directives:
Port 22022
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
On newer systems you can instead drop a file in /etc/ssh/sshd_config.d/:
bash
sudo tee /etc/ssh/sshd_config.d/hardening.conf >/dev/null <<'EOF'
Port 22022
PermitRootLogin no
PasswordAuthentication no
EOF
3. Allow the new port through the firewall
```bash
Ubuntu
sudo ufw allow 22022/tcp
RHEL family
sudo firewall-cmd --permanent --add-port=22022/tcp sudo firewall-cmd --reload ```
Also update ALYPOD's firewall/security-group rules if you use them.
4. Validate and reload
bash
sudo sshd -t # syntax check
sudo systemctl reload ssh # or sshd on RHEL
5. Test before closing your old session
From a new terminal:
bash
ssh -p 22022 [email protected]
Only once this works should you close the old session and optionally close port 22.
Troubleshooting
- Problem: locked out entirely. Solution: use the console VNC or rescue mode
to revert
sshd_configand reload the service. - Problem: "connection refused" on the new port. Solution: the firewall does not
allow it, or sshd failed to reload — check
sshd -t. - Problem: SELinux blocks the new port (RHEL). Solution:
semanage port -a -t ssh_port_t -p tcp 22022.
Related articles
- [Adding and managing SSH keys]
- [Managing users and sudo access]
- [Initial server hardening after installation]
