Change the SSH port safely

Changing the SSH port reduces noise from automated scanners, but does not secure a server by itself. The real risk is cutting your own access midway. The safe method is to open the new port before touching the configuration, then validate from a second session before closing the old one.

Debian 13 includes /etc/ssh/sshd_config.d/*.conf at the top of sshd_config. A provider or cloud-init file can therefore override a setting made further down. Put your change in a dedicated file:

sudo sshd -T | grep -i '^port'

This prints the value actually applied, not just the one you think you wrote. The service is named ssh on Debian 13.

Open the new port first

Pick a port between 1024 and 65535, for example 2222, and allow it before any restart.

With UFW:

sudo ufw allow 2222/tcp
sudo ufw status

Change and reload

sudoedit /etc/ssh/sshd_config.d/10-port.conf

Content:

Port 2222

Check the syntax, then reload without dropping existing sessions:

sudo sshd -t
sudo systemctl reload ssh
sudo ss -tlnp | grep 2222

reload re-reads the configuration and leaves current connections open. Keep your first session alive: it is your safety net.

Test from a second session

ssh -p 2222 utilisateur@VOTRE_IPV6

Do not close the first session until this works. Test the admin account too, and key authentication if you use it. Only then remove the old rule:

sudo ufw delete allow 22/tcp

Check that sudo sshd -T | grep -i '^port' returns only 2222: a leftover Port 22 line may come from another file in sshd_config.d/.

If you lose access

Open the noVNC console from the dashboard, log in as root, then remove the port file and reload the service. Check journalctl -u ssh -n 50 and ufw status: the cause is almost always a closed firewall or a syntax error.

Verify

sudo sshd -T | grep -i '^port'
sudo ss -tlnp | grep -E ':22|:2222'
sudo journalctl -u ssh --since "10 min ago"

The new port must listen, the old one must no longer answer, and login must work with a key and with a password if you still allow both. Adjust the Fail2ban jail if you configured it with an explicit port.