> For the complete documentation index, see [llms.txt](https://testnet-docs.gitbook.io/cardano-testnets/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://testnet-docs.gitbook.io/cardano-testnets/oracle-cloud/steps-to-harden-instance/change-ssh-port.md).

# Change ssh port

### 1. Edit Security List on OCI

From the **OCI control panel** navigate to **Compute > Instances** and **select your instance**. You should see something like this:

<figure><img src="/files/JFJ6SwB9UxYK1PMggtNZ" alt=""><figcaption></figcaption></figure>

Click on the **subnet**:

<figure><img src="/files/sR5PRB9cELF3n6YfXr29" alt=""><figcaption></figcaption></figure>

Next, either make a new **Security List**, or simply edit the **Default**:

<figure><img src="/files/WUkqupHGXmwwk1fYQjvc" alt=""><figcaption></figcaption></figure>

Add a new **Ingress Rule**:

<figure><img src="/files/rcO3iXzBNzSgyYtkFTQ3" alt=""><figcaption></figcaption></figure>

In the following panel enter the required information:

* **Source Type:** CIDR
* **Source CIDR:** either 0.0.0.0/0 or \<the-ip-you'll-be-connecting-from>/32
* **IP Protocol:** TCP
* **Destination Port Range:** \<the-port-you-want-to-use-for-ssh>
* **Description:** something that makes sense to you

{% hint style="danger" %}
**Please note:** DO NOT delete the default SSH (port 22) Ingress Rule at this point
{% endhint %}

<figure><img src="/files/B609gLzuQJF7Pyeb6sPC" alt=""><figcaption></figcaption></figure>

### 2. Change SSH listening port in the daemon

Next, connect to your instance as you did [here](/cardano-testnets/oracle-cloud/connecting-to-your-instance.md) and change SSH port on the VM:

```sh
# Edit the ssh configuration file
sudo nano /etc/ssh/sshd_config

# Find the line that says #Port 22 and replace it with:
Port <the-port-you-selected-earlier>

# Save your changes and reload the daemon
sudo systemctl restart sshd
```

More details about this process can be found [here](https://www.ubuntu18.com/ubuntu-change-ssh-port/).

{% hint style="danger" %}
**Please note:** you must include the following steps for this to work in OCI
{% endhint %}

### 3. Manage ingress rules with firewalld

Install firewalld and set new rules:

```bash
# Install firewalld
sudo apt install firewalld

# Firewalld should come enabled and auto-start. In case it doesn't do:
sudo systemctl enable firewalld
sudo systemctl start firewalld

# Add the new ssh port to the public zone
sudo firewall-cmd --zone=public --add-port=<the-port-you-selected-earlier>/tcp --permanent 

# Reload firewalld rules
sudo firewall-cmd --reload

# Check that the rule stuck
sudo firewall-cmd --list-all                
```

{% hint style="danger" %}
**Please note:** before disconnecting your current session, open a new Terminal session and ssh using your new port&#x20;
{% endhint %}

```sh
# Connecting to your instance with the new port (add the -p flag)
ssh -i "<path-to-the-new-oracle-key>" -p <the-port-you-selected-earlier> <your-chosen-username>@<the-ip4-address-of-the-new-vm>
```

{% hint style="info" %}
A couple of links regarding this process:

[Ways to manage access to OCI instances](https://stackoverflow.com/questions/62326988/cant-access-oracle-cloud-always-free-compute-http-port);

[Problems with firewalld rules](https://unix.stackexchange.com/questions/492124/setting-firewall-cmd-permanent-is-not-sticking-after-reboot);

[Controlling system access with firewalld](https://docs.fedoraproject.org/en-US/quick-docs/firewalld/);

[Opening ports to specific IPs](https://www.tutorialspoint.com/how-to-open-port-for-a-specific-ip-address-in-firewalld#:~:text=Opening%20a%20Port%20for%20a%20Specific%20IP%20Address%20in%20Firewalld,-Now%20that%20you\&text=Ensure%20that%20the%20service%20is%20active%20and%20running.\&text=Identify%20the%20appropriate%20zone%20for%20your%20network%20interface.\&text=Replace%20with%20the%20appropriate,with%20the%20identified%20IP%20address.);

[Managing traffic with zones in firewalld](https://access.redhat.com/documentation/it-it/red_hat_enterprise_linux/7/html/security_guide/sec-using_zones_to_manage_incoming_traffic_depending_on_source).
{% endhint %}