Change SSH Port on Agent Host

Complete procedure for changing the default SSH port (22) to a custom port on the Hostinger VPS (Agent Host), including server-side and client-side changes, firewall updates, and verification.

Prerequisites:

• Current SSH access to the VPS (via ssh hostinger-vps)
• sudo access on the VPS
• Your local machine’s SSH config at ~/.ssh/config
• Cloudflare Tunnel configured for hermes.ducatillon.net (CF Tunnel bypasses local firewall — HTTP/HTTPS services are unaffected)
• 10-15 minutes
• Pick a port number before starting (e.g. 2468). Use a port between 1024 and 65535 that is not in use. This guide uses PORT as placeholder — replace it with your chosen number.

---

Overview

On Ubuntu 24.04, sshd is socket-activated by default — systemd listens on port 22 via ssh.socket and spawns sshd on demand. Changing sshd_config alone is not enough; the socket unit still binds to port 22. You must disable socket activation so sshd listens directly on the new port.

Steps:

1. VPS — Edit sshd_config to set the new port
2. VPS — Disable socket activation, restart sshd
3. VPS — Open new port in UFW, close port 22
4. Local — Update your SSH config to use the new port

---

Step 1: Verify current state

On the VPS:

# Confirm port 22 is active
sudo ss -tlnp | grep ssh

# Check UFW rules
sudo ufw status verbose

# Check sshd_config
grep -E '^#?Port' /etc/ssh/sshd_config

# Check socket activation status
systemctl is-active ssh.socket

Expected: port 22 listening, UFW allows 22/tcp, #Port 22 commented out, ssh.socket active.

---

Step 2: Edit sshd_config

On the VPS:

sudo nano /etc/ssh/sshd_config

Find the line:

#Port 22

Uncomment it and change the port number:

Port PORT

Save and exit (Ctrl+O, Enter, Ctrl+X).

---

Step 3: Disable socket activation and restart sshd

On the VPS:

# Stop and disable the socket unit (it hardcodes port 22)
sudo systemctl stop ssh.socket
sudo systemctl disable ssh.socket

# Restart sshd — it now listens directly on the new port
sudo systemctl restart ssh

Verify:

sudo ss -tlnp | grep ssh

Expected: only :PORT should be listening, :22 should be gone.

Important: If you only run systemctl restart ssh without disabling ssh.socket, the socket still binds to port 22 and your config change has no effect.

---

Step 4: Update UFW

On the VPS:

# Allow the new port
sudo ufw allow PORT/tcp comment 'SSH custom port'

# Remove port 22 (one command removes both IPv4 and IPv6)
sudo ufw delete allow 22/tcp

# Verify
sudo ufw status

Expected: only PORT/tcp should appear as ALLOW IN.

---

Step 5: Test the new port (from your local machine)

On your local machine, open a new terminal (do not close your current VPS session yet):

ssh -p PORT hermes@srv1715245.hstgr.cloud

Or using your SSH host alias with an override:

ssh -p PORT hostinger-vps

If this connects successfully, the new port works.

If it does NOT work, debug from your existing VPS session:

# Check sshd is listening on the new port
sudo ss -tlnp | grep PORT

# Check UFW
sudo ufw status

# Check sshd config is valid
sudo sshd -t

# Check ssh logs
sudo journalctl -u ssh --since "5 minutes ago"

---

Step 6: Update local SSH config

On your local machine, edit ~/.ssh/config:

Host hostinger-vps
    User hermes
    HostName srv1715245.hstgr.cloud
    Port PORT
    IdentityFile ~/.ssh/hostinger_vps_ed25519
    RequestTTY force

Key change: added Port PORT line.

Verify it works:

# Final test from local machine (close old SSH sessions first)
ssh hostinger-vps

---

Final state checklist

On the VPS:

# Only new port listening
sudo ss -tlnp | grep ssh
# Expected: only :PORT

# UFW only allows new port
sudo ufw status
# Expected: PORT/tcp ALLOW, no 22/tcp

# sshd_config has only the new port
grep '^Port' /etc/ssh/sshd_config
# Expected: Port PORT

# Socket activation disabled
systemctl is-active ssh.socket
# Expected: inactive

On your local machine: ssh hostinger-vps connects on the new port.

---

What is NOT affected

• Hermes gateway (local service, not reachable from internet directly)
• Dashboard (9119) (behind Cloudflare Tunnel, bypasses local firewall entirely)
• Cloudflare Tunnel (outbound-only connection, no inbound port changes needed)
• Any other local services (they bind to 127.0.0.1 behind the tunnel)

The only thing that changes is how you SSH into the box from your local machine.