VPS security
Set up SSH keys without losing access to your VPS
Create an SSH key, install the public key and test a new login before changing password access.
Read the guide
Moving SSH away from port 22 can reduce routine scan noise, but it does not replace keys, updates or a firewall. The main risk is changing the listener before the new port is reachable.
Check how SSH is running
Start from a working SSH session and keep it open. Check the listening ports and whether Ubuntu is using socket activation. The ssh.socket unit can control the listener on some releases, so reloading ssh.service alone may not apply a port change.
sudo ss -ltn
systemctl status ssh.socketLook for the address and port used by SSH. The socket command may report an inactive or missing unit on a traditional service installation. Follow the official instructions for your Ubuntu release if the socket is active.
Allow the new port first
Choose a free TCP port, such as 2222 in this example. Add an allow rule to both the VPS Control Panel firewall and any firewall inside the guest. With UFW, the following allows the new port without removing the old rule.
sudo ufw allow 2222/tcp
sudo ufw statusKeep the current SSH port allowed until the new one is tested. A guest firewall change does not update an upstream firewall. If access is restricted by source address, check that your current public address is still permitted.
Update the configuration and validate it
Back up the SSH file or snippet you intend to edit. Set the new Port value using sudoedit, and check for other Port or ListenAddress settings that may affect it. OpenSSH can listen on both old and new ports during a transition.
sudo sshd -tNo output normally means the syntax check passed. Fix any errors first. Apply the service or socket procedure for your release, then run sudo ss -ltn again. The new port must appear in the listener list before you try it remotely.
Prove the new connection works
Open a second terminal on your own computer and connect using the new port. Check the account, administrator access and any file-transfer tools you use. Keep the original session available while you do this.
ssh -p 2222 vpsuser@server.example.comOnly remove the old listener and firewall rule after the new connection is reliable. Update saved SSH profiles, monitoring and deployment tools too. If the test fails, use the open session or browser console to restore the previous settings.
