Is it recommended to have sshd listening on a non-standard port? The Ubuntu community documentation has a line which states:

It's not recommended to listen on a non-standard port.

It's on this page. I've always followed this practice and never had problems. Could you specify any situation where the non-standard port would not be a good idea.

  • It really depends on why - if just for hiding it, than maybe not. If for setting up a special service for a particular application, then perhaps it is what you need. – Shannon Nelson Nov 9 '09 at 5:21

If you have a machine which you want a number of people to be able to SSH into, running on a non-standard port might make it more confusing for them.

If it's just you, however, running on a port other than 22 has no real drawbacks (assuming you can remember the port number) and it will greatly reduce the number of connection attempts you get from bots performing dictionary attacks.

  • No real drawbacks - as long as he doesn't choose a port that another application relies on. – John T Nov 9 '09 at 3:55
  • You will still get the connection attempts. You'll no longer see them, though. – innaM Nov 9 '09 at 9:20

Things you should really do when running an ssh server are to turn off root ssh and only use private/public key authentication. Changing the port in my opinion is a low form of security.

  • i am using the keys for authentication, it was the comment on the documentation that confused me. it had no argument for the statement and i've heard that using a non-standard port is generally a good idea, and definitely not the only method of security. – Chintan Nov 10 '09 at 3:58

Running SSH on a non-standard port is akin to re-locating the ignition key slot in a car to the trunk. Security though obscurity is not security, but it does foil robot scripts that are to stupid to see the extension cord running from the dash through the back seat.

The best way to secure SSH is to prevent root logins completely, and to enforce the use of key pairs by disabling password logins. Additionally, don't take the lazy way out and make password-less keys.

Fighting brute force attacks is better than hiding from them, you don't want those IP's accessing any service on the system once they fail to login as root 100 times in a row. Its rather easy to monitor log files for this and use firewall tools (iptables) to block future requests.

The combination is much more secure .. and you don't have to confuse users with a non standard port :)

  • +1 for iptables only allow some ip-numbers. – Johan Nov 9 '09 at 6:08

Some caveats with this:

  • You may choose a port which another application already uses
  • Some (poorly coded) applications may have this value hardcoded in as the SSH port, but most will be flexible and allow you to specify a port
  • If other users will be given SSH access, you will need to make sure you've told them it runs on a different port to avoid those annoying late night phone calls

If these aren't an issue for you, go for it!


If you want to run SSH on a standard port, then do yourself a favor and install Blockhosts. Install it, configure it, add it to cron and you should be safe for the most part. At least all brute force attempts won't be useful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.