Port 22 SSH · TCP

What runs on port 22

SSH: encrypted remote shell, plus everything built on it: SCP and SFTP file transfer, git over ssh, port forwarding and tunnels, rsync over ssh, Ansible. It is the one port most servers have open to the world, and the most brute-forced port on the internet by a wide margin.

Software that uses it: OpenSSH · Dropbear · libssh · Windows OpenSSH Server · Gitea/GitLab/GitHub (git over ssh)

Should port 22 be open?

Internet-facing only with authentication and care. It can be exposed when the service behind it is authenticated, rate-limited and kept up to date; most deployments are better off behind a VPN, an allow-list or a reverse proxy.

• Disable password authentication and use keys; brute force then becomes noise.
• Moving to another port reduces log spam but is not a security measure; fail2ban or a VPN is.
• ssh -v shows the negotiated key exchange and cipher when debugging.

Check port 22

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :22'
sudo lsof -i :22

# from another machine: is it reachable?
nc -zv host 22
nmap -p 22 host
curl -v telnet://host:22      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 22

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 22 proto tcp
sudo ufw deny 22/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 22 accept
nft add rule inet filter input tcp dport 22 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=22 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 22" with no source is just "open".

Related ports

• 23 Telnet — Plaintext remote shell; should be off
• 21 FTP — FTP control; plaintext, replace with SFTP
• 873 rsync — rsync daemon
• 9418 git — git:// protocol

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions