🛠️ The Right Way to Change the Default SSH Port (22) on macOS

1. Background

On macOS, we sometimes need to change SSH’s default port (22). Common reasons include:

• Port conflicts: for example, tools like OrbStack or GitLab Runner occupy the local port 22.
• Security: to avoid being scanned on the public internet, you may want a non-standard port (like 2222).

2. ⚠️ The Common “Wrong” Approach (Why the Linux Method Doesn’t Work)

On Linux, we usually just change Port in /etc/ssh/sshd_config. On macOS, that approach usually does not work.

• ❌ Editing /etc/ssh/sshd_config:
  • Why: macOS’s SSH service is managed by launchd. launchd listens on the port first, and only starts the sshd process after a request arrives. So editing sshd’s config file alone cannot change the entry port launchd listens on.
• ❌ Editing /System/Library/LaunchDaemons/ssh.plist:
  • Why: This is a core system file protected by SIP (System Integrity Protection). Even with sudo or SIP disabled, editing this file is very troublesome and easily overwritten by system updates.

---

3. ✅ The Right Approach: Change the System Service Mapping

On macOS, the simplest and most durable fix is to change the SSH port mapping in the system services list.

Step 1: Edit /etc/services

We need to change the default port the system defines for the “ssh” service.

1. Open Terminal and edit the service configuration file with vim:

   sudo vim /etc/services

2. Type /ssh and press Enter to search for the SSH definitions.

3. Find these two lines (usually near the beginning of the file):

   ssh              22/udp     # SSH Remote Login Protocol
   ssh              22/tcp     # SSH Remote Login Protocol

4. Press i to enter edit mode and change 22 to the port you want (for example 2222):

   ssh              2222/udp     # SSH Remote Login Protocol
   ssh              2222/tcp     # SSH Remote Login Protocol

5. Press Esc to leave edit mode, then type :wq to save and quit.

Step 2: Restart the SSH Service

Once the change is made, restart the system service so launchd re-reads the configuration.

Run the following commands in order:

# 1. Stop the SSH service (unload the configuration)
sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist

# 2. Start the SSH service (reload the configuration)
sudo launchctl load /System/Library/LaunchDaemons/ssh.plist

(Note: if you’re not comfortable with the commands, rebooting the machine achieves the same thing.)

---

4. Verifying the Result

Once the change is made, try connecting to localhost over the new port to test it:

# Use -p to specify the new port
ssh localhost -p 2222

If you see a login prompt or log in successfully, the change worked.

---

💡 A Note: Changing Other SSH Settings

Although changing the port can’t be done with sshd_config, other SSH settings (such as disabling password login or allowing root login) still follow the standard approach.

• How to change them: edit /etc/ssh/sshd_config directly.
• How to apply them: after editing, run the same launchctl unload/load commands above to restart the service.