Skip to main content
protocols.pageprotocols.page
22

Port 22 – SSH / SFTP / SCP

TCP

Port 22 is the standard port for SSH (Secure Shell), SFTP (SSH File Transfer Protocol), and SCP (Secure Copy). All three use the SSH protocol for encrypted communication. Port 22 should be protected with public-key authentication and rate limiting – it is the most attacked port on the internet.

Port Number

22

Protocol

TCP

Service

Secure Shell

Range

IANA Well-Known (0–1023)

Description

SSH on port 22 provides encrypted remote shell access, file transfer via SFTP, and secure copy via SCP. It replaced Telnet (port 23) and FTP as the standard for remote administration. Many security guides recommend changing the default port or using port knocking to reduce automated attacks.

Security risks

  • 1Brute-force attacks: port 22 receives millions of automated login attempts daily. Use fail2ban (ban after 5 failures), AllowUsers directive, and disable PasswordAuthentication entirely in favor of Ed25519 keys.
  • 2Weak key algorithms: RSA keys under 2048 bits and DSA keys are vulnerable. Use Ed25519 (ssh-keygen -t ed25519) for all new keys. Audit with: ssh-audit target.
  • 3Agent forwarding hijack: ssh -A exposes your local SSH agent to the remote host. A compromised server can use your forwarded agent to access other machines. Use ProxyJump (-J) instead of agent forwarding.
  • 4Known-hosts TOFU: first connection accepts any key (Trust On First Use). An attacker on the network path during first connect can MITM permanently. Verify host key fingerprints out-of-band or use SSHFP DNS records.

Firewall guidance

Allow inbound port 22 only from known management IPs or VPN ranges. Never allow 0.0.0.0/0 inbound SSH in production. Use a bastion/jump host pattern: one hardened SSH entry point, all other servers accept SSH only from the bastion. Cloud security groups should reference the bastion's security group, not IP ranges.

Diagnosis commands

Verbose SSH connection debugging – shows key exchange, auth methods, and failures

shell
ssh -vvv user@host 2>&1 | grep -E '(debug1|Authenticated)'

Count active SSH connections

shell
ss -tnp sport = :22 | wc -l

Count brute-force attempts in the last hour

shell
journalctl -u sshd --since '1 hour ago' | grep -c 'Failed password'

Audit SSH server configuration – algorithms, key sizes, vulnerabilities

shell
ssh-audit host

Usage examples

Port 22 – SSH / SFTP / SCP
shell
ssh [email protected]
ssh -p 22 [email protected]
sftp [email protected]
scp file.txt [email protected]:/path/

Common services on this port

OpenSSHDropbearlibsshParamikoPuTTYBitvise SSH ServerTeleport

Related ports

21

FTP (unencrypted predecessor)

2222

SSH alternate port

443

HTTPS (SSH over HTTPS tunneling)

History

SSH was created by Tatu Ylonen in 1995 after a password-sniffing attack at Helsinki University of Technology. SSH-1 was proprietary; SSH-2 (RFC 4251, 2006) was standardized by the IETF. OpenSSH (1999) became the universal implementation, shipping with every Linux, macOS, and Windows 10+ system.

FAQ

Should I change SSH from port 22 to a non-standard port?

It reduces automated scanner noise in logs (~99% of bots only probe port 22) but provides zero security against targeted attacks. Do it for log cleanliness, not as a security measure. Key-based auth + fail2ban is the real protection.

Is SFTP the same as FTPS?

No. SFTP runs inside SSH (port 22, single connection). FTPS wraps FTP in TLS (ports 990/989 or STARTTLS on 21, dual channel). They are completely different protocols that happen to transfer files securely.

Specification

RFC 4251 – Port 22 specification →