diff --git a/debug.go b/debug.go
index 318e93e..cadbd8e 100644
--- a/debug.go
+++ b/debug.go
@@ -23,6 +23,9 @@ type DebugCmd struct {
 	Kernel string `help:"regexp (first match)" required:""`
 	Gdb    string `help:"gdb listen address" default:"tcp::1234"`
 
+	SshAddr string `help:"ssh address to listen" default:"127.0.0.1"`
+	SshPort int    `help:"ssh port to listen" default:"50022"`
+
 	ArtifactConfig string `help:"path to artifact config" type:"path"`
 
 	Kaslr bool `help:"Enable KASLR"`
@@ -69,6 +72,11 @@ func (cmd *DebugCmd) Run(g *Globals) (err error) {
 		return
 	}
 
+	err = q.SetSSHAddrPort(cmd.SshAddr, cmd.SshPort)
+	if err != nil {
+		return
+	}
+
 	if ka.Qemu.Cpus != 0 {
 		q.Cpus = ka.Qemu.Cpus
 	}
diff --git a/qemu/qemu-kernel.go b/qemu/qemu-kernel.go
index d75e329..aa0ff38 100644
--- a/qemu/qemu-kernel.go
+++ b/qemu/qemu-kernel.go
@@ -127,6 +127,12 @@ func NewSystem(arch arch, kernel Kernel, drivePath string) (q *System, err error
 	return
 }
 
+func (q *System) SetSSHAddrPort(addr string, port int) (err error) {
+	// TODO validate
+	q.sshAddrPort = fmt.Sprintf("%s:%d", addr, port)
+	return
+}
+
 func getRandomAddrPort() (addr string) {
 	// 127.1-255.0-255.0-255:10000-50000
 	ip := fmt.Sprintf("127.%d.%d.%d",
@@ -215,7 +221,9 @@ func (q System) cmdline() (s string) {
 // Start qemu process
 func (q *System) Start() (err error) {
 	rand.Seed(time.Now().UnixNano()) // Are you sure?
-	q.sshAddrPort = getFreeAddrPort()
+	if q.sshAddrPort == "" {
+		q.sshAddrPort = getFreeAddrPort()
+	}
 	hostfwd := fmt.Sprintf("hostfwd=tcp:%s-:22", q.sshAddrPort)
 	qemuArgs := []string{"-nographic",
 		"-hda", q.drivePath,