I've got a CentOS 6.4 machine and would like to change the default SSH port, and followed these instructions:
After making those changes (including the "semanage port -a -t ssh_port_t -p tcp 2345"), and restarting SSHD, I'm still not able to connect via the new, alternate port.
I see that the host is listening on the new port:
# netstat -antp | grep 2345 | grep LISTEN
tcp 0 0 0.0.0.0:2345 0.0.0.0:* LISTEN 6998/sshd
tcp 0 0 :::2345 :::* LISTEN 6998/sshd
And I see the SELINUX policy appears to be correct:
# /usr/sbin/semanage port -l | grep ssh
ssh_port_t tcp 2345, 22
And I see the IPTABLES appear to be correct, too:
# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- virbr0 any anywhere anywhere udp dpt:domain
0 0 ACCEPT tcp -- virbr0 any anywhere anywhere tcp dpt:domain
0 0 ACCEPT udp -- virbr0 any anywhere anywhere udp dpt:bootps
0 0 ACCEPT tcp -- virbr0 any anywhere anywhere tcp dpt:bootps
179K 145M ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
185 7200 ACCEPT icmp -- any any anywhere anywhere
2 99 ACCEPT all -- lo any anywhere anywhere
39 2028 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:ssh
29763 11M REJECT all -- any any anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any virbr0 anywhere 192.168.122.0/24 state RELATED,ESTABLISHED
0 0 ACCEPT all -- virbr0 any 192.168.122.0/24 anywhere
0 0 ACCEPT all -- virbr0 virbr0 anywhere anywhere
0 0 REJECT all -- any virbr0 anywhere anywhere reject-with icmp-port-unreachable
0 0 REJECT all -- virbr0 any anywhere anywhere reject-with icmp-port-unreachable
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 118K packets, 24M bytes)
pkts bytes target prot opt in out source destination
Lastly, I can telnet to the port locally:
# telnet localhost 2345
Trying ::1...
Connected to localhost.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.3
But cannot telnet to or SSH to the new, alternate port from outside.
I'm not behind a firewall of any sort.
Any ideas, suggestions? I'm flummoxed.
Dan
ssh
with the-v
option to get more verbose output? Are you connecting from the same LAN ('outside' is kind of vague) or not?