Port 22: the port of the SSH protocol

Port 22 is a well-known port number used in computer networking. It is specifically associated with the Secure Shell (SSH) protocol, which is commonly used for secure remote administration and secure file transfer over an unsecured network.

What is Port 22 used for?

Here are some key points about port 22 and its significance.

Secure Shell (SSH): SSH is a cryptographic network protocol that provides secure communication between networked devices. It establishes an encrypted connection, allowing users to remotely access and administer systems securely. SSH is widely used in various operating systems, including Unix, Linux, and macOS.

Secure Remote Administration: Port 22 is primarily used for secure remote administration of systems. It enables system administrators to securely log in to remote servers or devices and perform administrative tasks. With SSH, administrators can access a command-line interface or execute remote commands securely. If you run WordPress, see our guide on how to use SSH with WordPress.

Security and ports

In addition to remote administration, SSH also facilitates secure file transfer between devices. It provides a secure alternative to traditional file transfer methods like FTP (File Transfer Protocol) by encrypting the data being transferred. Users can securely copy files to or from remote servers using tools like SCP (Secure Copy) or SFTP (Secure File Transfer Protocol) over port 22.

Port 22 is part of the TCP/IP protocol suite, which is the foundation of the modern internet. TCP/IP uses port numbers to identify specific services or applications running on devices connected to a network. Port 22 is the designated port for SSH, allowing devices to establish secure connections for remote administration and file transfer.

It’s important to note that port 22 must be open and accessible on the network for SSH connections to be established. In some cases, firewalls or network security measures may block or restrict access to port 22 for security reasons. Administrators and users should ensure that the necessary network configurations and firewall rules are in place to allow SSH connections if required.

How Secure Shell (SSH) work on port 22?

Secure Shell (SSH) works on port 22 by establishing a secure and encrypted communication channel between a client and a server. Here’s a simplified explanation of how SSH operates on port 22:

When an SSH client initiates a connection to an SSH server, it typically communicates on port 22. The client sends a connection request to the server, indicating its intent to establish an SSH session.

Once the initial connection request is made, the SSH client and server engage in a cryptographic handshake. They negotiate encryption algorithms, key exchange methods, and authentication mechanisms. This process ensures that the subsequent communication is encrypted and secure.

During the cryptographic handshake, the client and server exchange cryptographic keys. These keys are used to establish a secure and private communication channel between the client and server. The keys are generated uniquely for each SSH session, providing confidentiality and integrity for the data transmitted over the connection.

Authentication

After the key exchange, the SSH server requests user authentication from the client. The client must provide valid credentials, typically in the form of a username and password, to prove its identity. Alternatively, SSH also supports more secure authentication methods such as public key authentication or certificate-based authentication. Using wrong login credentials can lead to a permission denied error.

Once the client’s identity is verified, the SSH session is fully established, and the client and server can securely exchange data. All communication between the client and server, including commands, responses, and file transfers, is encrypted using the negotiated encryption algorithms.

During the SSH session, the client and server can interact securely. The client can send commands to the server, which executes them and returns the output. Secure file transfers can also be performed using protocols like SCP (Secure Copy) or SFTP (Secure File Transfer Protocol).

SFTP over port 22

SFTP runs inside the SSH connection described above — same port, same handshake, same encryption. Once the session is established, instead of a command shell you get a file transfer interface: upload, download, rename, delete, create directories and change permissions, all within the encrypted channel.

SFTP also verifies checksums during transfer, ensuring files arrive intact.

FTP (Port 21) vs SFTP (Port 22)

SFTP (Secure File Transfer Protocol) and FTP (File Transfer Protocol) are both file transfer protocols, but they differ significantly in terms of security and functionality.

As the name suggests, it’s a secure protocol that operates over SSH (Secure Shell) and provides secure file transfer capabilities over port 22. It encrypts both commands and data during transmission, ensuring confidentiality and integrity. SFTP offers strong authentication and supports key-based authentication methods. It also provides additional features like directory listing, remote file management, and resuming interrupted transfers. SFTP is widely adopted as a secure alternative to FTP, particularly in scenarios where data protection is a priority.

On the other hand, FTP is an older protocol that lacks built-in encryption, and works on port 21. It transfers data in plain text, making it susceptible to eavesdropping and tampering. FTP relies on separate channels for command and data transmission, which can introduce complications in firewall configurations. FTP does not have native support for encryption or secure authentication methods. While FTP is still used in certain environments, it is typically discouraged for transmitting sensitive or confidential information over public networks due to its security vulnerabilities.

Can SSH and SFTP run on a different port, other than 22?

Yes, SSH and SFTP can be configured to run on ports other than the default port 22. The port number on which SSH or SFTP operates can be changed to enhance security or accommodate specific network configurations. Here’s how it can be done:

SSH:

• Server Configuration: To change the SSH port, you need to modify the SSH server configuration file (typically located at /etc/ssh/sshd_config on Unix-like systems).
• Locate the “Port” directive in the configuration file and change the value to the desired port number (e.g., Port 2222).
• Save the configuration file and restart the SSH service for the changes to take effect.
• From that point on, SSH clients need to connect to the SSH server using the new port number (e.g., ssh username@hostname -p 2222).

SFTP:

• SFTP Subsystem Configuration: SFTP runs as a subsystem of the SSH server, and the port change for SFTP is associated with the SSH port change.
• Follow the steps mentioned above to modify the SSH server configuration file and change the SSH port to the desired port number (e.g., Port 2222).
• After making the changes and restarting the SSH service, SFTP will automatically use the modified SSH port for establishing secure file transfer connections.

It’s important to note that when changing the default port for SSH or SFTP, you need to consider a few factors:

• Security: Changing the port number may provide some level of security through obscurity. It can make it slightly more difficult for automated bots or scripts to target the default port. However, it’s essential to implement other security measures alongside port changes for comprehensive security.
• Firewall and Network Configurations: Ensure that the new port is allowed through firewalls or network security devices. Adjust any network configurations, such as port forwarding or NAT (Network Address Translation), to reflect the new port number.
• Client Configuration: SSH and SFTP clients will need to be configured to connect using the new port number. The clients should be updated with the appropriate port option, such as “-p 2222” for SSH or specifying the port during SFTP connection setup.

On a cPanel server, SSH sits alongside the panel’s own ports — see the full cPanel ports list.

Always keep in mind that when changing the default port for SSH or SFTP, it may impact interoperability with other systems or users who expect the services to be running on the standard ports. To ensure users are informed about any modifications made to the default port numbers, it is essential to provide clear communication and documentation.

What is a TCP/IP Port?

Ports are divided into three main categories:

1. Well-Known Ports: Ports ranging from 0 to 1023 are known as “well-known ports” or “reserved ports.” These ports are assigned to common services and protocols and are widely recognized. Examples include port 80 for HTTP, port 443 for HTTPS, port 53 for DNS, port 21 for FTP, and port 25 for SMTP. These ports are standardized to facilitate communication between devices.
2. Registered Ports: Ports ranging from 1024 to 49151 are known as “registered ports” or “user ports.” They are reserved for specific applications and services, often registered with the Internet Assigned Numbers Authority (IANA) to avoid conflicts. Many custom applications and specific services use ports within this range.
3. Dynamic or Private Ports: Ports ranging from 49152 to 65535 are referred to as “dynamic ports” or “private ports.” They are used for temporary and ephemeral communications, where the port number is dynamically assigned by the operating system or application during a communication session. These ports are used to avoid conflicts with registered ports and allow for communication between temporary applications on devices.

Port 22 is part of the TCP/IP suite, where port numbers let a single IP address serve many applications at once. Each packet carries both the destination address and the port, so the operating system knows which application should receive it. Port numbers belong to the transport layer — layer 4 of the OSI model, which organises network communication into seven levels.

Port 22 is one of roughly thirty numbers that come up in everyday work. Our full list of common TCP and UDP ports covers the rest, grouped by what each one does.

Frequently asked questions

What is port 22 used for?

Port 22 is the default port for SSH (Secure Shell), the protocol used for secure remote administration of servers. SFTP and SCP — the secure file transfer protocols — also run on it, because both operate inside an SSH connection rather than as separate services.

Is port 22 TCP or UDP?

TCP. SSH needs reliable, ordered delivery: commands must arrive intact and in sequence, and a lost packet has to be retransmitted rather than dropped. UDP offers none of that, which is why it isn’t used here.

Should I change the SSH port from 22?

It reduces noise rather than risk. Automated bots scan port 22 constantly, so moving SSH to another port cuts the volume of login attempts in your logs — but it’s security through obscurity, not real protection. A targeted scan finds the new port in seconds. Change it if the log noise bothers you, but rely on key-based authentication and a firewall for actual security.

How do I change the SSH port?

Edit /etc/ssh/sshd_config, change the Port directive to your chosen number, save and restart the SSH service. Two things to do before disconnecting: allow the new port in your firewall, and open a second session on the new port to confirm it works — otherwise a mistake locks you out of the server.

Is port 22 open by default?

On most Linux servers and VPS instances, yes — SSH is how you administer them, so it has to be. On shared hosting it usually isn’t, and SSH access has to be requested or enabled in the control panel. If a connection fails, check whether the port is open before assuming the credentials are wrong.

What is the difference between SFTP and FTP?

SFTP runs over SSH on port 22 and encrypts both the commands and the data. FTP uses port 21 and transmits everything, including your password, in plain text. FTP also uses separate channels for commands and data, which complicates firewall configuration. For anything travelling over a public network, SFTP is the correct choice.

Is SFTP the same as FTPS?

No, despite the similar names. SFTP is a subsystem of SSH and runs on port 22. FTPS is traditional FTP with a TLS layer added, and uses port 21 or 990. They’re unrelated protocols that happen to solve the same problem.

Why is my SSH connection refused on port 22?

Either nothing is listening on that port, or something is blocking it. Check that the SSH service is running with systemctl status sshd, confirm the port with ss -tlnp | grep :22, and verify the firewall allows it. On shared hosting, SSH access may simply not be enabled for your account.

Can I use a password instead of an SSH key?

You can, but keys are considerably safer. A password can be guessed by the same bots that scan port 22 all day; an SSH key can’t be brute-forced in any practical sense. On servers exposed to the internet, the usual configuration is key-based authentication with password login disabled entirely.

What port range does 22 belong to?

The well-known ports, 0 to 1023 — the range reserved for standard services and assigned by IANA. That’s why SSH clients connect to port 22 without being told: every implementation knows the assignment.

Conclusion

Port 22 is one of those assignments that has held for so long it barely registers as a choice: every SSH client in existence tries it first, which is convenient for you and equally convenient for the bots that scan it around the clock. That’s the trade-off at the centre of this port — universal compatibility on one side, constant automated attention on the other.

The practical takeaways are three. SFTP and SCP aren’t separate services — they run inside the SSH connection, which is why they share the port and inherit the same encryption. Changing the port reduces log noise rather than risk, so do it if the noise bothers you, but don’t mistake it for security. And key-based authentication is what actually protects the door: a key can’t be guessed, a password can.

If you’re on shared hosting and SSH isn’t available, that’s usually by design rather than by omission. The moment you need to edit sshd_config, tune a firewall or manage your own keys, you’ve outgrown the shared environment — and that’s a VPS conversation, not a support ticket.

Running your own mail server is one of the more demanding things you’ll do over SSH — see what a self-hosted email server takes before committing to it.