SSH stays on port 22 even after editing sshd_config

Question

I tried changing my SSH port from 22 to 220 but it stays on 22. I used sudo nano /etc/ssh/sshd_config to change the daemon config and uncommented the line with Port 22 and changed it.

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Include /etc/ssh/sshd_config.d/*.conf

# Port and ListenAddress options are not used when sshd is socket-activated,
# which is now the default in Ubuntu.  See sshd_config(5) and
# /usr/share/doc/openssh-server/README.Debian.gz for details.
Port 220
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
KbdInteractiveAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and KbdInteractiveAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem   sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#   X11Forwarding no
#   AllowTcpForwarding no
#   PermitTTY no
#   ForceCommand cvs server

I restarted the ssh service with sudo service ssh restart I also tried sudo systemctl restart ssh I also tried sudo systemctl daemon-reload Made sure ssh is enabled with sudo systemctl enable ssh I did several sudo apt update and reinstalled openssh-server. I checked for syntax errors with sudo sshd -t

I have ufw disabled.

Wenn I sudo systemctl status ssh it outputs:

● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/lib/systemd/system/ssh.service; enabled; preset: enabled)
    Drop-In: /etc/systemd/system/ssh.service.d
             └─00-socket.conf
     Active: active (running) since Tue 2023-10-10 10:51:20 CEST; 19min ago
TriggeredBy: ● ssh.socket
       Docs: man:sshd(8)
             man:sshd_config(5)
    Process: 9804 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
   Main PID: 9805 (sshd)
      Tasks: 2 (limit: 1959)
     Memory: 5.5M
        CPU: 462ms
     CGroup: /system.slice/ssh.service
             ├─5792 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"
             └─9805 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"

Oct 10 10:51:20 homePi systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Oct 10 10:51:20 homePi systemd[1]: ssh.service: Found left-over process 5792 (sshd) in con>
Oct 10 10:51:20 homePi systemd[1]: This usually indicates unclean termination of a previou>
Oct 10 10:51:20 homePi sshd[9805]: Server listening on :: port 22.
Oct 10 10:51:20 homePi systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Oct 10 10:51:59 homePi sshd[9870]: Accepted password for xxx from 192.168.178.56 port 4184>
lines 1-23

Answer 1

Although you don't mention the OS, I'm guessing it's Ubuntu because of this comment in sshd_config:

Port and ListenAddress options are not used when sshd is socket-activated, which is now the default in Ubuntu. See sshd_config(5) and /usr/share/doc/openssh-server/README.Debian.gz for details.

This is immediately above your Port entry. >_<

That comment isn't in the version on RpiOS, but it still may be using the socket activation. To check:

> systemctl status ssh.socket
● ssh.socket - OpenBSD Secure Shell server socket
     Loaded: loaded (/lib/systemd/system/ssh.socket; disabled; vendor preset: enabled)
     Active: inactive (dead)
     Listen: [::]:22 (Stream)

Notice it says "vendor preset: enabled". I'm not sure if that is true, since I have no memory of disabling this, nor can I find a trace of it in the scripts I use to bootstrap a new system. I am not using port 22, so this definitely not being used.

If it is, you could disable this, but there is a simpler suggestion in /usr/share/doc/openssh-server/README.Debian.gz under the heading Per-connection sshd instances with systemd (there's an explanation of what "socket-activated" means there too):

The provided ssh.socket unit file sets ListenStream=22. If you need to have
it listen on a different address or port, then you will need to do this as
follows (modifying ListenStream to match your requirements):

I'll restate the instructions that follow because the original might be a bit cryptic. You need to create a file /etc/systemd/system/ssh.socket.d/listen.conf; you may need to create the ssh.socket.d directory first. All this should be owned root, and in the file:

   [Socket]                                                                                                                                                                     
   ListenStream=220  

Or whatever port number you want. To enable this:

sudo systemctl daemon-reload
sudo systemctl restart ssh.socket                                                                                                                                                       
                                                                                                                                                                      

Or just reboot.