1

I've got a CentOS 6.4 machine and would like to change the default SSH port, and followed these instructions:

CentOS Wiki

After making those changes (including the "semanage port -a -t ssh_port_t -p tcp 2345"), and restarting SSHD, I'm still not able to connect via the new, alternate port.

I see that the host is listening on the new port:

# netstat -antp | grep 2345 | grep LISTEN
tcp        0      0 0.0.0.0:2345                0.0.0.0:*                   LISTEN      6998/sshd           
tcp        0      0 :::2345                     :::*                        LISTEN      6998/sshd 

And I see the SELINUX policy appears to be correct:

# /usr/sbin/semanage port -l | grep ssh
ssh_port_t                     tcp      2345, 22

And I see the IPTABLES appear to be correct, too:

# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  virbr0 any     anywhere             anywhere            udp dpt:domain 
    0     0 ACCEPT     tcp  --  virbr0 any     anywhere             anywhere            tcp dpt:domain 
    0     0 ACCEPT     udp  --  virbr0 any     anywhere             anywhere            udp dpt:bootps 
    0     0 ACCEPT     tcp  --  virbr0 any     anywhere             anywhere            tcp dpt:bootps 
 179K  145M ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 
  185  7200 ACCEPT     icmp --  any    any     anywhere             anywhere            
    2    99 ACCEPT     all  --  lo     any     anywhere             anywhere            
   39  2028 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:ssh 
29763   11M REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    virbr0  anywhere             192.168.122.0/24    state RELATED,ESTABLISHED 
    0     0 ACCEPT     all  --  virbr0 any     192.168.122.0/24     anywhere            
    0     0 ACCEPT     all  --  virbr0 virbr0  anywhere             anywhere            
    0     0 REJECT     all  --  any    virbr0  anywhere             anywhere            reject-with icmp-port-unreachable 
    0     0 REJECT     all  --  virbr0 any     anywhere             anywhere            reject-with icmp-port-unreachable 
    0     0 REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT 118K packets, 24M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Lastly, I can telnet to the port locally:

# telnet localhost 2345
Trying ::1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.3

But cannot telnet to or SSH to the new, alternate port from outside.

I'm not behind a firewall of any sort.

Any ideas, suggestions? I'm flummoxed.

Dan

1
  • Please include the actual command you are running to connect, as well as the specific error messages you receive. Did you try ssh with the -v option to get more verbose output? Are you connecting from the same LAN ('outside' is kind of vague) or not?
    – terdon
    Sep 20, 2013 at 4:23

2 Answers 2

1

It looks like your iptables aren't configured to allow on port 2345, only on 22, which is passed through with the rule

tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:ssh

You will want a rule that does the same for port 2345, and you can get that with

iptables -A INPUT -p tcp --dport 2345 -m conntrack --ctstate NEW -j ACCEPT

and you'll want that rule right where your old SSH rule was. This is all assuming you are using plain iptables to configure your firewall and not some wrapper for it. If the latter case, you will probably want to use the wrapper program to change the port from 22 to 2345.

For future reference, if you can connect to a service fine through localhost, but not from outside, then the problem is with your network (e.g. firewall). Localhost will have different behavior because the traffic will go through the loopback device, which on your system is set to accept all traffic through.

1
  • Hi Aaron, thanks for you reply but running the command you suggest still doesn't make this work. Although this isn't documented anywhere, might a change to /etc/services also be needed? I'm stumped.
    – Dan
    Sep 20, 2013 at 2:53
0

What I did in the end was use the GUI Firewall to open port 2345, save, and reload firewall, and now I'm good to go.

I do see this made a change to the /etc/sysconfig/iptables file, but for some reason my command line attempts did not work.

In short, what needed to be done was the following:

1) add alternate port to /etc/ssh/sshd_config:

Port 2345 # the additional SSH port
Port 22 # just in case

2) Install "semanage" to make change to SELinux:

# yum -y install policycoreutils-python

3) Add new port to SELinux policy:

# semanage port -a -t ssh_port_t -p tcp 2345

4) Restart SSHD:

# service sshd restart

5) Within CentOS Firewall GUI, in "Other Ports" add 2345 as TCP (ignore fact that it thinks service is DBM), Apply, Reload

Done

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .