Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I currently run a server with SSH on a non-standard port for security reasons. That was 522 on CentOS 5, but CentOS 6 doesn't (easily) allow SSH to run on any port below 1024, other than 22 obviously. For CentOS 6 I've been using a much higher port (>10000), but I now have to run it on 522 (for a variety of unsavoury hosting/firewall issues introduced by my hosting provider). I'm running a kernel > 2.6.24 and SELinux.

I believe it's possible, perhaps using CAP_NET_BIND_SERVICE and setcap, but I can't find a good reference. Any help much appreciated.

share|improve this question

migrated from Feb 27 '13 at 17:58

This question came from our site for professional and enthusiast programmers.

There is a post on the CentOS How To's about how to secure SSH on a system. Section five talks about using a non-standard port:

  1. Use a Non-Standard Port

By default, ssh listens for incoming connections on port 22. For a hacker to determine ssh is running on your machine, he'll most likely scan port 22 to determine this. An effective method is to run ssh on a non-standard port. Any unused port will do, although one above 1024 is preferable. Many people choose 2222 as an alternative port (as it's easy to remember), just as 8080 is often known as the alternative HTTP port. For this very reason, it's probably not the best choice, as any hacker scanning port 22 will likely also be scanning port 2222 just for good measure. It's better to pick some random high port that's not used for any known services. To make the change, add a line like this to your /etc/ssh/sshd_config file:

# Run ssh on a non-standard port:
Port 2345  #Change me

Then when using SSH to connect just specify the -p switch if your doing it from another Linux server. Or if your using something like PuTTY change the port there.

share|improve this answer

You must log in to answer this question.