The sshd port doesn't change after editing sshd_config in Ubuntu

A short preface: in the course of my work I most often deal with Debian and RHEL/Centos distributions.
So somehow I missed the changes in recent versions of the Ubuntu distribution described below🫣

Now for the case itself💼

Recently, while writing a playbook for a previous post, I ran into a nuance of how the sshd daemon behaves in Ubuntu 24: after changing the server’s listening port in the /etc/ssh/sshd_config file and restarting the service:

systemctl restart ssh

The listening port didn’t change. That is:

ss -tln

The system was still listening on port 22:

tcp  LISTEN  0  4096  *:22  *:*

It turns out that in Ubuntu, starting from version 22 / 23.10 if I’m not mistaken, the ssh daemon uses a socket-based model for connecting clients to the server. So the usual service restart has no effect😐

Without knowing this nuance, you can really mess things up, for example, when configuring a server, if after editing the config and doing such a “restart” you close the old port with a firewall😬

Let me tell you a bit more about this behavior of uebuntu 😡

If you conditionally connect to the server console (not via ssh) and run:

pgrep -af ssh

You’ll find that there is no ssh service at all🤷‍♂️
But at the same time:

tcp  LISTEN  0  4096  *:22  *:*

The mechanism here is as follows: instead of the usual systemd unit ssh.service, the socket unit — ssh.socket — is active by default. The point of this model is to avoid keeping the ssh daemon process active all the time, to quote: “for the purpose of saving resources”🧏‍♂️

In the socket-based model, when a request comes in on the given port (22 by default), it hits the systemd socket, which in turn starts the ssh.service to activate the daemon and establish the client connection🙄

If we look at the contents of the socket unit:

systemctl cat ssh.socket

We’ll see that the listening port is specified here:

[Socket]
ListenStream=22

Now, what to do in this case💀

After changing the port number in the sshd_config file, for example to 2222, to apply the changes you need to reload the init system’s configuration and restart the socket unit(!):

systemctl daemon-reload

systemctl restart ssh.socket

# check
ss -tln

The listening port should change:

tcp LISTEN  0  4096  *:2222  *:*

Now let’s look at the socket unit config:

systemctl cat ssh.socket

And we see the new port:

[Socket]
ListenStream=
ListenStream=2222

Done✔️

If you need to revert to the classic sshd operation model, here are the steps described on the official Ubuntu site:

# disable the socket
systemctl disable --now ssh.socket

# remove socket configs
rm -f /etc/systemd/system/ssh.service.d/00-socket.conf

rm -f /etc/systemd/system/ssh.socket.d/addresses.conf

# reload configuration
systemctl daemon-reload

# start/enable the service
systemctl enable --now ssh.service

This behavior turned out to be unexpected for me. You can’t keep track of everything🤷‍♂️

👨‍💻And…

Don’t forget about our Telegram channel 📱 and chat

Or maybe you want to become a co-author? Then click here🔗

💬 All the best ✌️

That should be it. If not, check the logs 🙂