Port 22 (SSH)

Secure Shell: remote shell access, SFTP and scp file transfer, Git over SSH and port forwarding. OpenSSH listens here by default.

Well-known (system) port, 0-1023 TCP Remote access Expose only to trusted sources

What port 22 is used for

Secure Shell: remote shell access, SFTP and scp file transfer, Git over SSH and port forwarding. OpenSSH listens here by default.

Security: should port 22 be open?

Expose only to trusted sources. One of the most scanned ports on the internet; expect constant password-guessing bots. Disable password login (PasswordAuthentication no), use keys, disable root login, and limit access to known IPs, a VPN or a bastion host. fail2ban or sshguard cut the noise. Moving SSH to another port reduces log spam but is not a security control.

IANA assignment

Service nameProtoDescriptionAssigneeReference

ssh TCP The Secure Shell (SSH) Protocol
Defined TXT keys: u=<username> p=<password> - RFC 4251

ssh UDP The Secure Shell (SSH) Protocol
Defined TXT keys: u=<username> p=<password> - RFC 4251

ssh SCTP SSH
Defined TXT keys: u=<username> p=<password> Randall Stewart RFC 9260

Registry dates for this port: last modified 2022-02-07.

Check what is listening on port 22

Linux: is anything listening on TCP 22?

sudo ss -tlnp 'sport = :22'

Linux / macOS: which process owns the port

sudo lsof -nP -i :22

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':22 '

Windows (Command Prompt)

netstat -ano | findstr :22

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 22 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 22

From Windows

Test-NetConnection HOST -Port 22

Allow only trusted sources on port 22 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 22 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 22 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 22 accept
sudo nft add rule inet filter input tcp dport 22 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 22 trusted' -Direction Inbound -Protocol TCP -LocalPort 22 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.