The firewall decides who can even knock. UFW makes the rule a one-liner - and the famous port change deserves a fair hearing: it quiets the noise, it is not armour, and done in the wrong order it locks you out.
Ubuntu's UFW is the friendly face of the system firewall, and SFTP needs exactly one opening in it. This guide adds that rule, shows how to restrict it to your office network only, and then deals honestly with the most repeated piece of SSH advice on the internet: moving the port.
sudo ufw allow OpenSSH - the profile knows the port, so the rule stays correct even in writingsudo ufw enable if the firewall is not already on - do this while you still have a working session, and confirm the allow rule exists first, or the firewall will politely cut your own connectionsudo ufw status verbose to read back the result: default deny incoming, your one rule listedUFW is a front end, not the firewall itself - the rules it writes are what matter, and status is how you prove they exist instead of believing they do.
On a LAN server, "anywhere" is wider than necessary. You can allow only your office range:
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp, adjusting the range to your networksudo ufw delete allow OpenSSHThis one change makes internet-style scanning irrelevant to a local server - the door only exists for your own street.
Moving SSH from 22 to something like 2222 has exactly one real benefit: your logs go quiet, because the endless automated scans aim at the standard port. That is genuinely pleasant and makes real events easier to spot.
What it does not do: stop a determined attacker, who scans all ports anyway, or fix weak passwords, which fail on any port. Treat it as noise reduction, never as the security itself. Keys are the security; the port is the volume knob.
/etc/ssh/sshd_config set Port 2222 - keep your current session opensudo ufw allow 2222/tcpsudo systemctl restart sshsftp -P 2222 [email protected] (in sftp and ssh the flag is a capital P)sudo ufw delete allow OpenSSHSee the whole Ubuntu SFTP setup done live, with the exact clicks and commands, in the Technical Anshu video.
Watch Full VideoThe allow rule was missing or added after enabling. The firewall blocked your own connection along with everyone else's. Recovery needs console access to the machine; add the OpenSSH rule first, then enable.
No. A port is just a number; what listens behind it and how it authenticates decides safety. A key-only SSH on port 22 is stronger than a password-based SSH on an obscure port.
No. SFTP uses TCP port 22 only - one of its practical advantages over old FTP, which needed extra data connections.