Port 22SSH

What port 22 is used for

SSH provides an encrypted, authenticated channel between a client and a server. Over that one channel run several services that all use port 22:

• Interactive shell sessions: the ssh user@host you type to administer a Linux server, a router or a Windows machine with OpenSSH Server.
• SFTP and SCP file transfers, including the back end of tools such as WinSCP and FileZilla in SFTP mode.
• Git over SSH: [email protected]:org/repo.git style remotes.
• Port forwarding and tunnels that carry other protocols (databases, VNC, web consoles) through the SSH connection.
• Automation: Ansible, rsync over SSH, CI deploy steps.

SSH replaced Telnet and rlogin, which sent passwords in clear text.

How the connection is protected

The client and server negotiate encryption keys during the handshake, so everything after the version exchange is encrypted. The server proves its identity with a host key; the first time a client connects it stores that key, and a later mismatch produces the well-known "REMOTE HOST IDENTIFICATION HAS CHANGED" warning. Users authenticate with a password, a key pair, or a certificate. Key authentication is stronger because there is no password to guess.

Security considerations

Port 22 is among the most scanned ports on the internet. Any host with 22 open to the world receives login attempts within minutes. The protocol is sound; the risk is weak configuration.

• Use key authentication and disable passwords (PasswordAuthentication no in sshd_config).
• Disable direct root login (PermitRootLogin no) and give administrators individual accounts.
• Restrict sources: firewall rules, a VPN, or AllowUsers / Match Address blocks in the server configuration.
• Rate-limit or ban repeat failures with fail2ban or equivalent.
• Keep OpenSSH updated. Vulnerabilities are rare but serious when they occur.

Changing the port (for example to 2222) reduces log noise but does not stop targeted attacks; scanners test all 65,535 ports.

How to check port 22

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :22

A line in the LISTENING state means a local program has bound port 22; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :22 or lsof -i :22.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection example.com -Port 22

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 22. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Test SSH specifically, including the server's identification banner, with the OpenSSH client that ships with Windows:

ssh -v [email protected]

The verbose output shows the connection, the server version string and each authentication method attempted. See the ssh record.

Firewall considerations

Servers that offer SSH need inbound TCP 22 allowed from administrative networks only. A workstation running OpenSSH Server for occasional use should allow it on the Private profile and block it on Public. Home routers should not forward port 22 to a LAN device unless that device is specifically hardened for it.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 22 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.