Changing the SSH port on AlmaLinux 9 often results in lost connectivity because the firewall, SELinux policies, and the sshd service configuration are not updated in unison. This guide resolves these issues by ensuring all three components align with your new port number.
Update the SSH Daemon Configuration
The first step is to inform the Secure Shell daemon (sshd) that it should listen on a non-standard port. By default, sshd listens on port 22. You must edit the main configuration file located at
/etc/ssh/sshd_config. Open this file using your preferred text editor, such as
nano or
vim, and locate the line that specifies the port. It may be commented out with a hash symbol (
#). Remove the hash and change the value to your desired port, for example,
Port 2222. Ensure you choose a port above 1024 to avoid conflicts with system services. After making this change, save the file and exit the editor. Do not restart the service yet, as the firewall rules still block traffic on the new port.
Configure SELinux Policies
AlmaLinux 9 uses SELinux (Security-Enhanced Linux) to enforce security policies. If you change the SSH port without updating SELinux, the service will fail to start or connect because it lacks permission to bind to the new port. You can verify the current context of SSH ports using the command
semanage port -l | grep ssh. To add a new port to the allowed list, use the
semanage utility. For example, if you chose port 2222, run:
sudo semanage port -a -t ssh_port_t -p tcp 2222
If the port already exists in the policy but with a different type, you may need to modify it instead using
-m. Always verify the change was applied by running the
semanage port -l command again. This step is critical; skipping it is the most common reason for "Connection Refused" errors after changing the port.
Adjust Firewall Rules
The next layer of protection is the firewall. AlmaLinux 9 typically uses firewalld by default. You must open the new port in the firewall configuration. Use the
firewall-cmd tool to add the port to the public zone. Run the following command to add the port permanently:
sudo firewall-cmd --permanent --add-port=2222/tcp
After adding the port, reload the firewall to apply the changes immediately:
sudo firewall-cmd --reload
If you are using legacy iptables instead of firewalld, you would need to edit the
/etc/sysconfig/iptables file directly or use
iptables-save and
iptables-restore. However, on modern AlmaLinux systems, firewalld is the standard. You can verify that the port is open by checking the firewall status:
sudo firewall-cmd --list-all
Look for your new port in the
ports: section of the output. Note that if you previously had port 22 open, you might want to remove it from the firewall once you confirm the new port works, though keeping both open temporarily aids in troubleshooting.
Restart Services and Test Connectivity
Now that the configuration files, SELinux policies, and firewall rules are aligned, you can restart the SSH service. Use the following command:
sudo systemctl restart sshd
Check the status to ensure there are no errors:
systemctl status sshd
Before disconnecting your current session, test the new connection from a terminal window. Try connecting to the server using the new port:
ssh -p 2222 username@your_server_ip
If you can successfully log in, the configuration is correct. If the connection fails, check the journal logs for specific error messages using
journalctl -u sshd. Common issues include typos in the port number or incorrect SELinux contexts. Once verified, you can close your current session.
Prevent Lockout During Remote Changes
A significant risk when changing SSH ports remotely is losing access if something goes wrong. To mitigate this, always maintain an active console session or use a tool like
tmux or
screen before restarting the service. Alternatively, configure a second SSH instance listening on port 22 alongside your new port during the transition period. Edit
/etc/ssh/sshd_config.d/ or create a drop-in configuration file to allow dual listening. Once you have confirmed stable access via the new port for several days, you can disable port 22 entirely for enhanced security. This approach ensures you never lock yourself out of your server due to misconfiguration. For more advanced network routing scenarios, you might also consider
Forwarding www traffic through a remote computer if you are integrating this SSH setup into a broader proxy architecture.
Frequently Asked Questions
Why does my SSH connection timeout even after opening the port?
This usually indicates that SELinux is blocking the service rather than the firewall. Verify that your new port is listed in the SELinux policy using
semanage port -l. If it is missing, add it as described in the SELinux section. Additionally, ensure that no other firewall appliance between your client and server is blocking the traffic.
Can I keep port 22 open while testing the new port?
Yes, you can configure sshd to listen on multiple ports simultaneously. Add additional
Port lines in
/etc/ssh/sshd_config for each port you wish to support. Remember to update both the firewall and SELinux policies for every new port added. This is the safest way to migrate without risking immediate lockout.
How do I revert the changes if I get locked out?
If you lose SSH access, you must use the provider's console or VNC interface to log in. From there, edit
/etc/ssh/sshd_config to restore the original port 22 setting. Also, ensure SELinux and firewall rules are corrected. Restarting the sshd service will then restore standard access.
Does changing the SSH port improve security?
It reduces automated bot attacks significantly since most scanners target port 22 by default. However, it is not a substitute for strong authentication methods like SSH keys or fail2ban. Port obfuscation is a defense-in-depth strategy, not a complete security solution.
What if I am using iptables instead of firewalld?
You must manually add a rule to accept TCP traffic on your new port. Use
iptables -I INPUT -p tcp --dport NEW_PORT -j ACCEPT and then save the rules with
iptables-save. Unlike firewalld, iptables changes are not persistent across reboots unless explicitly saved.