Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an internet facing web server that I also need to be able to SSH into. I'd like to update my server to change the SSH port from something other than 22 so there are fewer hits for unauthorized access. (This is not my primary security measure. Just an additional minor tweak. I'm also using fail2ban and turning off password login.)

How can I pick a port to use that I know won't cause issues/conflicts?

share|improve this question
1. See which ports are open 2. Research any other software you want to install 3. Pick a port not currently in use, or needed by future installs. – NickW May 20 '13 at 16:27
up vote 2 down vote accepted
netstat --inet -lnp

tells you which services are running on your machine. (Possible but improbable that others are just inactive at the moment.)

As long as you don't use one of them you are OK. You may choose a well known port of a service you are sure never to use. Telnet maybe :-) (But maybe there are attacks on that port, too.)

share|improve this answer

I'm sure you can use anyone of the 65,535 ports available. You just need to make sure the port you chose doesn't interfere with any other application ports.

share|improve this answer

The IANA assigns ports for specific services. I would reference this list when selecting a port.

share|improve this answer

/etc/services contains your machine's list of all named ports to services. The list is not comprehensive but does detail all the major protocols and their associated ports you'll typically find. That information in conjunction with the information received by running the command (you only care about tcp not udp) will give you guidance to an alternative port:

netstat --inet -lnp | grep '^tcp'

You mentioned other security measures - I know not what they are but as you are probably aware this change alone will not really disguise anything to someone running a portscanner such as nmap.

If this machine is connected directly to a public network hopefully you are using iptables and sshd's configuration to limit the connections and who can connect.

share|improve this answer

Any unused port should do but some ports are more equal than others. If you ever have to connect within a proxy or captive portal you might have better luck (ab)using ports used by well-known protocols such as 443, 995, 993, or 587.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.