Skip to main content
protocols.pageprotocols.page
2222

Port 2222 – SSH Alternate

TCP

Port 2222 is a common alternate SSH port used to reduce automated brute-force attacks against port 22. Moving SSH to 2222 provides zero security against targeted attacks but eliminates 99% of automated scanner noise from logs. DirectAdmin hosting panel also uses port 2222 for its control panel interface.

Port Number

2222

Protocol

TCP

Service

SSH (non-standard port)

Range

IANA Registered (1024–49151)

Description

Port 2222 is the most common non-standard SSH port chosen by administrators who move SSH off port 22. The practice reduces log noise from automated scanners that only probe port 22, but provides no meaningful security against determined attackers who will port-scan the target. DirectAdmin web hosting control panel defaults to port 2222 for its admin interface, creating potential conflicts on hosting servers. When using port 2222 for SSH, update: sshd_config (Port 2222), firewall rules, SSH client configs, and any automation that connects via SSH. Security-by-obscurity through port changes should complement – never replace – key-based authentication, fail2ban, and AllowUsers directives.

Security risks

  • 1False security: changing SSH from 22 to 2222 only hides from lazy scanners – targeted attackers and Shodan find non-standard SSH ports instantly via service fingerprinting
  • 2Port 2222 is the SECOND most-scanned SSH port after 22 – botnets specifically include 2222, 2200, 2022, and 22222 in their scan lists
  • 3DirectAdmin hosting panel uses 2222 – confusion between SSH and DirectAdmin leads to misapplied firewall rules (blocking admin access or exposing SSH)
  • 4Same SSH vulnerabilities apply regardless of port: weak passwords, key-based auth not enforced, outdated OpenSSH versions with known CVEs (CVE-2024-6387 regreSSHion)
  • 5Containers often remap SSH to 2222: Docker containers with sshd on 2222 may have weaker configurations than the host's SSH (root login enabled, password auth enabled)

Firewall guidance

If using 2222 for SSH: apply the same hardening as port 22 (key-only auth, fail2ban, AllowUsers directive). Moving SSH to a non-standard port provides minimal security benefit – invest in key-based auth and fail2ban instead. If running DirectAdmin: ensure SSH and DirectAdmin don't conflict (DA can be moved to 2222 while SSH stays on 22).

Diagnosis commands

Connect to SSH on alternate port

shell
ssh -p 2222 user@host

Fingerprint what service is actually on 2222 (SSH vs DirectAdmin vs honeypot)

shell
nmap -sV -p 2222 target

Audit SSH config regardless of port

shell
grep -E 'Port|PasswordAuthentication|PermitRootLogin' /etc/ssh/sshd_config

Check fail2ban protection status for SSH (works on any port)

shell
fail2ban-client status sshd

Usage examples

Port 2222 – SSH Alternate
shell
ssh -p 2222 user@host
sshd_config: Port 2222
nmap -p 2222 target

Common services on this port

SSH (non-standard port)DirectAdmin hosting panelDocker containers with sshdHoneypots (cowrie)

Related ports

22

SSH (standard port)

2222

SSH alternate (this port)

2200

SSH alternate (another common choice)

2022

DirectAdmin (alternate)

History

Port 2222 became popular as an 'alternate SSH' in the early 2000s when automated SSH brute-force botnets targeted port 22 exclusively. Security guides recommended changing the SSH port to reduce log noise. DirectAdmin (hosting panel, 2003) also adopted port 2222. Over time, scanners evolved to check common alternates, making the security benefit negligible. Modern best practice: keep SSH on 22, use key-based auth, and deploy fail2ban.

FAQ

Is changing SSH to port 2222 worth it?

Marginally. It reduces automated scan noise in logs (fewer failed password attempts from basic botnets) but provides zero protection against targeted attacks. Shodan fingerprints SSH on any port. Better investments: PasswordAuthentication no (key-only), fail2ban (auto-ban after 3 failures), AllowUsers (whitelist), and keeping OpenSSH updated. If you change the port, use something truly random (e.g., 47293) not a common alternate.

How do I tell if port 2222 is SSH or DirectAdmin?

nmap -sV -p 2222 target identifies the service. SSH shows 'OpenSSH' banner. DirectAdmin shows an HTTP response (it's a web panel). You can also: curl http://target:2222/ – if you get HTML, it's DirectAdmin; if connection hangs/refuses, it's SSH. On the server: ss -tlnp | grep 2222 shows the process (sshd vs directadmin).