ssh on a Higher Port Keeps Out The Bots

I moved sshd from TCP port 22 to a higher port 2026-08-01T23:31Z. I also put the endlessh tarpit on port 22. sshd has not seen a single password guessing attempt since then. The combination of ssh tarpit, and non-standard port works.

It’s well-known that any computer exposed to The Internet gets bombarded with SSH login attempts on TCP port 22. There’s lots of folklore about this, ranging from “ignore them, it’s always been that way”, to “don’t allow password logins” to “have sshd listen on a different port” to “use fail2ban”.

I advocate for a combination of tarpit on TCP port 22, and sshd listening on a higher numbered port. My experience is that this combination decreases the number of password guessing attempts, and it satisfies my urge to cause problems for the systems doing password guessing.

Here’s some anecdata to back up my position. I’ve had my blog running on the same IP address since 2024-05-25. I was lazy and left sshd listening on the default TCP port 22. At 2026-08-01T23:31:08Z, I reconfigured sshd to listen on a different port, setting endlessh to listen on TCP port 22.

Before changing sshd port number, between 2026-06-11T12:43:54Z and 2026-08-01T23:31:01Z, a span of 1234.8 hours, sshd logged 437,588 failed password guesses, 354 failed password guesses per hour. 3737 different IP addresses made those failed password guesses, 3 IP addresses per hour. It looks like each IP address makes an average of 115 incorrect user ID/password combos.

After starting endlessh on TCP port 22, sshd logged 0 (zero) failed passwords. endlessh logged 13,739 SSH connection attempts time outs between 2026-08-01T23:44:46Z and 2026-08-13T15:48:22Z, 280 hours, for a rate of 49 failed password guesses per hour. The rate of time outs is 80% of the rate of failed password guesses, so endlessh used some valuable password guesser wall clock time.

endlessh stalled 2053 unique IP addresses until they gave up, 7.33 per hour. That’s more than twice the rate of IP addresses that sshd failed passwords from. There’s fewer connections per hour, but more IP addresses make them. After a little thought, I believe this is password guessers giving up on my machine after the timeouts.

That seems conclusive. Run sshd on some high port, run a decoy on port 22. Problem solved.

Switching sshd Port

I did this all on a Debian machine, where sshd runs under the ssh service. My Arch Linux server uses sshd as the service name. I rehearsed these steps on a machine I had easy physical access to.

  1. Log in to the remote machine via ssh. I logged in twice, in two different xterms because I’m a belt and suspenders system admin. You don’t want to get locked out of a remote machine.
  2. Edit the file /etc/ssh/sshd_config. There will be a line like #Port 22. Change it to Port 7734, you get to pick your own port number adventure. Save the file.
  3. Restart sshd: sudo systemctl restart ssh worked for Debian.
  4. Since you’re still logged in (twice), you can check on sshd status: sudo systemctl status ssh. The output needs to say “Active (running)”. Check to ensure that it says something like “Server listening on 0.0.0.0 port 7734”.
  5. In a clean, fresh xterm, try to ssh in to the remote host with the new, non-standard, port number: ssh -p 7734 remote.machine
  6. If that doesn’t work, double check sshd_config, make sure you actually re-started sshd. The -p 7734 part of the ssh command has to name the port that sshd listens on. I’m not really too sure what to suggest in this situation. If you can’t figure it out, revert the change to file /etc/ssh/sshd_config, and re-start sshd. Don’t log out before you fix the problem. I imagine solutions exist for remote machines that you can’t ssh into, but they all involve phone calls, and on-site support and things like that.

Which TCP Port To Use

No matter what port I run sshd on, some computer(s) can have a configuration that would prevent it. The file /etc/services lists 5888 “well-known” ports on my laptop (Arch Linux). It’s hard to recommend any given port. I used 7734 in my example sshd re-configuration, but /etc/services lists “smip” as using 7734 as its port.

Ranges of ephemeral port numbers suggest that using 32768–60999 might not be a great idea, either. It must not be too dangerous, plenty of /etc/services entries are in that range.

I think you should avoid port 2222 - that seems to be a common higher port to assign it to. Smarter bottom feeders might know this.

Installing endlessh

I installed endlessh the hard way, no package manger, working without a net.

  1. I got the source (git clone https://github.com/skeeto/endlessh.git), compiled it, and moved the executable to /usr/bin/.
  2. I have a systemd service file, which I put in /etc/systemd/system/endlessh.service. Read that .service file to make sure you believe it.
  3. Run sudo systemctl daemon-reload
  4. Run sudo systemctl enable endlessh.
  5. Run sudo systemctl start endlessh.
  6. Check the status sudo systemctl status endlessh. Always check the status after a systemd start or restart. to ensure it is running.