🔒 SSH Port Change Almost Locked Me Out — Server Hardening War Stories

The Setup

Standard hardening advice: change SSH from port 22 to something non-standard. Makes automated scanning attacks less effective. Simple, right?

The Sequence of Events

1. Edit sshd_config: change Port from 22 to 2222
2. Restart sshd
3. Disconnect current SSH session
4. Try to reconnect on port 2222
5. Connection refused

That's the nightmare. You've changed the port, closed your session, and can't get back in.

What Saved Me

The firewall. I was using UFW and hadn't opened port 2222 before restarting sshd. The port changed, sshd restarted — but the firewall blocked 2222, and sshd was no longer listening on 22. Rescue: console access through the VPS provider's web panel. Without it, I'd have needed to rebuild the server.

The Rules Now

1. Open the new port in the firewall BEFORE restarting sshd. Always.
2. Keep the old session open until you've tested the new connection.
3. Enable console access on every server before doing anything risky.