Port 22 — SSH / SFTP

TCP well-known

What runs on port 22

Secure Shell — remote terminal access, and the transport for SFTP and SCP. Also what Git uses over SSH.

SSH multiplexes far more than a shell: SFTP, SCP, port forwarding, and Git all ride the same connection. That makes 22 the most valuable port on most machines and, correspondingly, the most attacked — an internet-facing host sees automated password attempts within minutes. The effective defences are key-only authentication and rate limiting; moving to a high port cuts log noise but stops nothing that scans the full range. If a connection hangs after the banner rather than failing outright, the usual cause is a MTU or keepalive problem rather than authentication.

Security considerations

The single most brute-forced port on the internet. Disable password authentication, use keys only, and consider fail2ban. Moving to a non-standard port reduces log noise but is not security.

Checking whether something is listening

# Linux / macOS — what is bound to the port
sudo lsof -i :22
sudo ss -lntp | grep :22

# Windows
netstat -ano | findstr :22
Get-NetTCPConnection -LocalPort 22

# is it reachable from outside?
nc -zv example.com 22
curl -v telnet://example.com:22

Freeing the port

# find the process, then stop it
sudo lsof -ti :22 | xargs kill        # Linux / macOS
netstat -ano | findstr :22            # note the PID, then:
taskkill /PID <pid> /F                    # Windows

Should this port be open to the internet?

Only with care. SSH is designed to be exposed, but it is also the most brute-forced port on the internet. Keys only, no password authentication, and rate limiting.

Opening or blocking port 22

Finding the port is usually the first half of the job. Start narrow — the second rule is there for services that genuinely serve the public, and most do not:

# ufw — Debian, Ubuntu
sudo ufw allow from 10.0.0.0/8 to any port 22 proto tcp
sudo ufw allow 22/tcp                   # only if it genuinely serves the public

# firewalld — RHEL, Fedora, CentOS
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=22 protocol=tcp accept'
sudo firewall-cmd --reload

# iptables, if you are still there
sudo iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j DROP

# Windows
New-NetFirewallRule -DisplayName "SSH / SFTP 22" -Direction Inbound -Protocol TCP -LocalPort 22 -RemoteAddress 10.0.0.0/8 -Action Allow

10.0.0.0/8 stands in for a private range — substitute your own. Note that a firewall rule does not undo a service bound to 0.0.0.0; it only stops packets reaching it, and a misconfigured or disabled firewall then exposes it immediately.

Quick reference

Frequently asked questions

Other common ports

• Port 23 — Telnet
• Port 25 — SMTP
• Port 53 — DNS
• Port 67 — DHCP server
• Port 68 — DHCP client
• Port 69 — TFTP
• Port 80 — HTTP
• Port 110 — POP3
• Port 123 — NTP
• Port 143 — IMAP
• Port 161 — SNMP
• Port 389 — LDAP
• Port 443 — HTTPS
• Port 445 — SMB
• Port 465 — SMTPS
• Port 514 — Syslog
• Port 587 — SMTP submission
• Port 636 — LDAPS

All port numbers