Port 22 (SSH): what it is, how it is attacked and how to secure it

Category hub: Ports, protocols and services

In one sentence: Port 22 is the network door for Secure Shell, how administrators log in to servers, so exposing it to the whole internet invites constant guessing and scanning.

What runs on this port

Port 22 carries SSH, short for Secure Shell. Administrators use it to log in to Linux servers, firewalls, switches, NAS boxes and cloud machines, and to move files securely. OpenSSH is the most widely used version.

SSH encrypts the session. It does not decide who gets in. That depends on your passwords, keys and settings.

Why attackers look for it

A server that answers on port 22 is a machine someone can log in to. Internet-wide scans find these quickly, and the login banner often shows the OpenSSH version. Attackers try common usernames and passwords, or look for old versions with published flaws.

SSH gives a command line, so a successful login is worth more than most footholds.

How it gets attacked

Weak or reused passwords. Automated guessing runs against port 22 around the clock.
Stolen or shared keys left on laptops or in code repositories.
Old OpenSSH versions with known flaws.
Root login and password login left on.

A real advisory is regreSSHion, CVE-2024-6387, published by Qualys on 1 July 2024. It is a signal handler race condition in the OpenSSH server. A race condition means the result depends on timing. Qualys said it allows unauthenticated remote code execution as root on glibc-based Linux systems. It is a regression, an old bug that came back. Qualys said it arrived in OpenSSH 8.5p1 and was fixed in 9.8p1, and that versions from 4.4p1 up to, but not including, 8.5p1 are not vulnerable. Qualys said Windows installations are not vulnerable and that exploitation needs very many attempts.

Who it affects and how badly

Sole trader to 10 staff. Usually a few cloud servers or a NAS. Worst case: a hijacked server used for spam or crypto mining.
10 to 250 staff. MSPs, SaaS start-ups and manufacturers often leave SSH open for convenience. A stolen login can reach customer data and backups.
250 plus and regulated firms. Fintech, telecoms and healthcare run many Linux estates. One exposed management port can give lateral movement into systems holding personal data.

How to check whether yours is exposed

Check firewall rules for inbound TCP 22 from any address, and for any alternative SSH port.
List every server and device with SSH switched on.
Look in the SSH logs for repeated failed logins from the internet. Qualys notes many “Timeout before authentication” lines can indicate exploitation attempts.
Check each OpenSSH version against the vendor’s notices.

How to secure it

Do not expose port 22 to the whole internet. Allow it only from a VPN or a short list of trusted addresses.
Use key-based login and turn password login off.
Add MFA for SSH where your tools allow it.
Disable direct root login.
Patch OpenSSH promptly, moving to a fixed version for regreSSHion.
If you cannot patch at once, Qualys documents a temporary workaround: set LoginGraceTime to 0. It stops the code execution risk but allows denial of service.
Rotate keys when staff leave and keep them out of repositories.
Block repeated failed logins automatically.

Related terms

Port 2222 (alternative SSH)
Brute force attack
Password spraying
Multi-factor authentication
CVE
CVSS

FAQ

Is it safe to change SSH to a different port?
It cuts scan noise but is not real protection. Restrict access and use keys instead.

What was regreSSHion?
CVE-2024-6387, a race condition in OpenSSH sshd that Qualys said allowed unauthenticated remote code execution as root on glibc-based Linux. It was fixed in OpenSSH 9.8p1.

Should SSH allow password login?
Key-based login is safer, and the advice here is to turn password login off where you can.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.