Network ports · 22
22 — SSH
Port 22 carries SSH: encrypted remote shell, SFTP, SCP and port forwarding.
Key facts
| Port | 22 |
|---|---|
| Transport | TCP |
| Service | Secure Shell |
| Also carries | SFTP, SCP, tunnels |
| Encryption | Yes, from the first packet |
| Range | Well-known (0–1023) |
One encrypted channel, many uses
SSH authenticates the server with a host key, negotiates encryption, and then multiplexes channels for a shell, file transfer or port forwarding. SFTP and SCP are subsystems of SSH, not separate services, which is why they use the same port.
Password authentication is vulnerable to online guessing. Key-based authentication removes that path; disabling password login and root login is the standard hardening step for any internet-facing host.
Reducing exposure
Moving SSH to a non-default port reduces log noise but is not a security control. The effective controls are key-only authentication, a firewall allowlist, rate limiting and a bastion or VPN for administrative access. Fail2ban-style blocking helps against opportunistic scans.
SSH tunnels are also a practical way to reach a database that should not be public: forward a local port to the remote service and keep the database bound to loopback.
Frequently asked questions
Does changing the SSH port make it secure?
It only reduces automated noise. Key-only authentication and network restrictions do the real work.
Is SFTP a different port from SSH?
No. SFTP runs inside SSH, so it normally uses the same port 22.