TCP port 22 is the standard network port reserved for Secure Shell (SSH) communications. If you manage a Linux server, work in cloud infrastructure, or handle remote file transfers, port 22 is likely the most important "gate" in your network architecture. It allows for encrypted, authenticated connections between a client and a remote host, effectively replacing older, insecure protocols like Telnet.

The Core Function of TCP Port 22

At its most fundamental level, port 22 is the listening post for the SSH daemon (sshd). When a client attempts to connect to a server via SSH, the request is directed to this port. If the port is open and the service is running, the server initiates a handshake to establish a secure, encrypted tunnel.

While primarily known for remote command-line access, port 22 facilitates several critical services:

  • Secure Command-Line Execution: Administrators can log into remote systems and execute commands as if they were physically present at the console.
  • SFTP (SSH File Transfer Protocol): A secure alternative to FTP that encrypts both commands and data, preventing sensitive information like passwords from being intercepted in plain text.
  • SCP (Secure Copy Protocol): A simpler, faster method for transferring individual files over an SSH connection.
  • SSH Tunneling (Port Forwarding): This allows users to wrap unencrypted traffic (like database connections or VNC sessions) inside an SSH-encrypted tunnel, protecting data as it traverses untrusted networks.

Technical Architecture of the SSH Protocol on Port 22

To understand why port 22 is significant, one must look at how the Secure Shell protocol operates. Unlike Telnet, which transmits data in cleartext, SSH was designed by Tatu Ylönen in 1995 specifically to combat password sniffing on university networks.

The Three-Layer Structure

The modern SSH-2 protocol (the industry standard) operates through three distinct layers:

  1. Transport Layer: This layer handles initial key exchange, server authentication, and sets up encryption and integrity checking. It ensures that the data moving through port 22 cannot be read or altered by a third party.
  2. User Authentication Layer: Once the encrypted tunnel is established, this layer verifies the identity of the user. It supports various methods, including traditional passwords, public-key pairs, and multi-factor authentication (MFA).
  3. Connection Layer: This layer manages the multiplexing of multiple logical channels over the single encrypted connection. This is what allows you to have a terminal session and an SFTP transfer running simultaneously through the same port 22 connection.

The Handshake Process

When a connection hits port 22, a complex negotiation occurs. First, the client and server agree on which version of the protocol to use. Then, they exchange a list of supported cryptographic algorithms. The server provides its public host key so the client can verify the server's identity. Using an algorithm like Diffie-Hellman, both parties generate a "shared secret" without ever sending that secret over the wire. This secret is used to encrypt all subsequent communication.

Why Port 22 Is a Constant Target for Attacks

Because port 22 is the default for almost every Linux server in existence—including those on AWS, Google Cloud, and Azure—it is the first place attackers look. If you monitor the logs of a fresh server with port 22 exposed to the public internet, you will often see "connection refused" or "failed password" attempts within minutes.

Automated Brute Force Scanning

Bots and malicious scripts constantly crawl the IPv4 address space, looking for open port 22s. Once found, they launch brute-force attacks, cycling through thousands of common username and password combinations (e.g., root, admin, user123).

Targeted Credential Stuffing

If an administrator's credentials have been leaked in a separate data breach, attackers will try those same combinations against any server they find with port 22 open. Because many people reuse passwords, this is an incredibly effective attack vector.

Exploitation of Unpatched SSH Daemons

While rare in modern, well-maintained distributions, vulnerabilities in the SSH daemon itself can occasionally be found. If port 22 is open and the software is outdated, an attacker might be able to gain unauthorized access without needing a password at all.

Practical Experience in Securing Port 22

Managing a fleet of servers requires more than just leaving the default settings in place. In our experience, a "naked" port 22 is a liability. Hardening the service is not just recommended; it is mandatory for any production environment.

Transitioning to Key-Based Authentication

The single most effective step you can take is to disable password authentication entirely. SSH keys (private/public key pairs) provide significantly higher entropy than even the most complex human-readable passwords.

To generate a secure key pair, we recommend using the Ed25519 algorithm, which is faster and more secure than older RSA keys: