How to change SSH port on Centos 6, 7, and 8.

How to change SSH port on centos 6

Changing SSH Port will help to secure your Linux VPS server, here is ultimate guide how to secure linux vps server.

The default port number is TCP port # 22, but you can set the port number that the sshd server listens.

To change the port, first of all, you will have to open the SSH configuration file:

/etc/ssh/sshd_config

Then type:

Port PortNumberHere

OR

ListenAddress IPv4Address:Port

ListenAddress IPv6Address:Port

ListenAddress Hostname:Port

If you have not specified a port, the sshd, by default, listens to the previously specified addresses and port options. You can allow multiple listenaddress and options in sshd_config.

Run ssh on a non-standard port # 2022 using Port option

To edit /etc/ssh/sshd_config, enter:

# vi /etc/ssh/sshd_config

Edit to set Port to 2022:

Port 2022

Save and close the file.

CentOS run ssh on a non-standard port # 2022 using

Try ListenAddress as follows:

## bind sshd to two IP address on a non-standard port ##

ListenAddress 192.168.1.5:2022

ListenAddress 203.1.2.3:2022

Save and close the file

Reload SSHD service

You should update the following before you restart the system and before the changes to be applied:

• SELinux configuration
• Firewall settings
• fail2ban settings

OpenSSH SELinux user

If you are using SELinux, add tcp port # 2022 to port contexts for OpenSSH server:

# semanage port -a -t ssh_port_t -p tcp 2022

Update firewall settings

Update firewall settings so that users can login using TCP # 2022.

To edit, /etc/sysconfig/iptables and open sshd port 2022:

# vi /etc/sysconfig/iptables

Edit/append as follows:

## delete or comment out port 22 line ##

## -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

## open port 2022

-A INPUT -m state --state NEW -m tcp -p tcp --dport 2022 -j ACCEPT

Save and close the file.

IPv6 users, edit /etc/sysconfig/ip6tables file too:

Temporally, stop the firewall by typing:

# service iptables stop

# service ip6tables stop

Fail2ban settings

Use fail2ban to update the rules.

Restart sshd on a CentOS

Type the following command to restart / reload SSHD service:

# service sshd reload

Verify new port settings with this netstat command:

# netstat -tulpn | grep sshd

Finally, star the firewall on a CentOS:

# service iptables start

## IPv6 ##

# service ip6tables start

Connect to ssh server on port # 2022 using ssh command:

ssh -p PortNumberHere user@server-name-here

ssh -p PortNumberHere user@server-name-here commandNameHere

ssh -p 2022 nixcraft@192.168.1.5

ssh -p 2022 nixcraft@192.168.1.5 df

To connect to ssh server on port # 2022 using scp command type:

scp -P PortNumberHere source user@server-name-here:/path/to/dest

scp -P 2022 resume.pdf nixcraft@nas01:/backups/personal/nixcraft/files/

To connect to ssh server on port # 2022 using sftp command type:

sftp -P PortNumberHere user@server-name-here

sftp -P 2022 nixcraft@192.168.1.5

To connect to ssh server on port # 2022 using rsync command type:

Change SSH port number with rsync command:

sync -av -e 'ssh -p PORT-NUMBER-HERE' source user@server-name

So to backup /home/vivek to server1.nixcraft.net.in at port number 2022, enter:

rsync -av -e 'ssh -p 2022' /home/vivek/ backupop@server1.nixcraft.net.in

 

How to change SSH port on centos 7

Changing the SSH port is actually pretty simple.

Open /etc/ssh/sshd_config and search for the following line:

Port 229

Be careful: choose an unused/not-well-known port (at least >1023).

Opening the new port on firewallD

Opening a port on firewallD is easy:

# firewall-cmd --add-port YOUR_PORT_HERE/tcp

Adding the new port to SELinux

Configuring SELinux to behave with the new port abd type the following:

# semanage port -a -t ssh_port_t -p tcp YOUR_PORT_HERE

Configuring Fail2Ban

Open /etc/fail2ban/jail.conf and search for the following section:

[sshd]

# To use more aggressive sshd filter (inclusive sshd-ddos failregex):

#filter = sshd-aggressive

port    = ssh

logpath = %(sshd_log)s

backend = %(sshd_backend)s

Change the value of port to the actual port by using:

[sshd]

# To use more aggressive sshd filter (inclusive sshd-ddos failregex):

#filter = sshd-aggressive

port    = 7222

logpath = %(sshd_log)s

backend = %(sshd_backend)s

Fail2Ban won’t be able to close the appropriate port.

Flip the switch

Type the followings to test the new configuration:

# systemctl restart sshd

# systemctl restart fail2ban

Try to ssh in your server using your new port:

$ ssh USERNAME@YOUR_IP/HOSTNAME -p YOUR_NEW_PORT

Mopping up:

If you’ve successfully ssh’d in your server, finalize the settings and mop up. Use the new port rather than the previous one.

SSH daemon

Configure the ssh daemon, open /etc/ssh/sshd_config  delete/comment out the following line:

Port 22

Now you have told sshd not to listen on port 22,  the default one.

FirewallD

Finalize the firewall configuration:

# firewall-cmd --add-port YOUR_PORT_HERE/tcp --permanent

# firewall-cmd --reload

Finalizing

This is the final step.

Type the following commands:

# systemctl restart sshd.service

# firewall-cmd --remove-service ssh --permanent

# firewall-cmd --reload

If by restarting sshd you encounter such an error;

job for sshd.service failed because the control process exited with error code. See "systemctl status sshd.service" and "journalctl -xe" for details.

Run journalctl –xe byfollowing command:

# journalctl –xe

The final output will be:

server1 kernel: type=1400 audit(1537086072.510:4): avc: denied { name_bind } for pid=1074 comm="sshd" src=6378 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unres

server1 sshd[1074]: error: Bind to port 6378 on 0.0.0.0 failed: Permission denied.

server1 sshd[1074]: error: Bind to port 6378 on :: failed: Permission denied.

server1 kernel: type=1400 audit(1537086072.515:5): avc: denied { name_bind } for pid=1074 comm="sshd" src=6378 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unres

server1 sshd[1074]: fatal: Cannot bind any address.

server1 systemd[1]: sshd.service: main process exited, code=exited, status=255/n/a

server1 systemd[1]: Failed to start OpenSSH server daemon.

Tell about this change by running the command below:

semanage port -a -t ssh_port_t -p tcp 3456

Now, verify that SELinux has allowed sshd to listen on the two ports:

semanage port -l | grep ssh

ssh_port_t  tcp      3456, 22

type:

yum whatprovides semanage

Output will be:

policycoreutils-python-2.5-22.el7.x86_64 : SELinux policy core python utilities

Repo : base

Matched from:

Filename : /usr/sbin/semanage

yum install -y policycoreutils-python

Test that you can login to the server with new SSH port

ssh -p 3456 root@server1

How to Change Default SSH Port in CentOS 8

Check Status of SSH Service in CentOS 8 using systemctl command:

[root@centos-8 ~]# systemctl status sshd.service

The screen will be as follow:

â sshd.service - OpenSSH server daemon

   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)

   Active: active (running) since Sat 2020-08-08 17:59:18 PKT; 2s ago

     Docs: man:sshd(8)

           man:sshd_config(5)

 Main PID: 1564 (sshd)

    Tasks: 1 (limit: 5916)

   Memory: 1.2M

   CGroup: /system.slice/sshd.service

           ââ1564 /usr/sbin/sshd -D -oCiphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,> 

Aug 08 17:59:18 centos-8.centlinux.com systemd[1]: Starting OpenSSH server daemon...

Aug 08 17:59:18 centos-8.centlinux.com sshd[1564]: Server listening on 0.0.0.0 port 22.

Aug 08 17:59:18 centos-8.centlinux.com sshd[1564]: Server listening on :: port 22.

Aug 08 17:59:18 centos-8.centlinux.com systemd[1]: Started OpenSSH server daemon.

We can tweak /etc/ssh/sshd_config file to customize SSH service according to our requirements.

There is no Port directive in this file and SSH service is using the default ssh port number 22.

Add a Port directive in sshd_config file by using echo command.

[root@centos-8 ~]# echo "Port 50" >> /etc/ssh/sshd_config

Configure SELinux to Allow Non-Default SSH Port:

SELinux configuration does not allow any service to run on a non-default port configure SElinux to allow SSH to use port 50/tcp.

Use semanage command to add port 50/tcp to type ssh_port_t:

[root@centos-8 ~]# semanage port -a -t ssh_port_t -p tcp 50

Configure Firewall to Allow Non-Default SSH port:

List down allowed ports or services in firewall.

[root@centos-8 ~]# firewall-cmd --list-all

You will see the following

public (active)

  target: default

  icmp-block-inversion: no

  interfaces: ens33

  sources:

  services: cockpit dhcpv6-client ssh

  ports:

  protocols:

  masquerade: no

  forward-ports:

  source-ports:

  icmp-blocks:

  rich rules:

Or you can type:

Systemctl firewalld

 

Block this ssh service and allow new ssh port in firewall.

[root@centos-8 ~]# firewall-cmd --permanent --remove-service=ssh

success

[root@centos-8 ~]# firewall-cmd --permanent --add-port=50/tcp

success

[root@centos-8 ~]# firewall-cmd --reload

success

Restart SSH Service on CentOS 8:

Type the following command to restart service:

[root@client  ~]# systemctl restart sshd

Verify status of SSH Service by typing:

[root@centos-8 ~]# systemctl status sshd.service

The screen will be:

â sshd.service - OpenSSH server daemon

   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)

   Active: active (running) since Sat 2020-08-08 18:13:37 PKT; 14s ago

     Docs: man:sshd(8)

           man:sshd_config(5)

 Main PID: 10376 (sshd)

    Tasks: 1 (limit: 5916)

   Memory: 1.2M

   CGroup: /system.slice/sshd.service

           ââ10376 /usr/sbin/sshd -D -oCiphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc>

Aug 08 18:13:37 centos-8.centlinux.com systemd[1]: Stopped OpenSSH server daemon.

Aug 08 18:13:37 centos-8.centlinux.com systemd[1]: Starting OpenSSH server daemon...

Aug 08 18:13:37 centos-8.centlinux.com sshd[10376]: Server listening on 0.0.0.0 port 50.

Aug 08 18:13:37 centos-8.centlinux.com sshd[10376]: Server listening on :: port 50.

Aug 08 18:13:37 centos-8.centlinux.com systemd[1]: Started OpenSSH server daemon.

Access Service using Non-Default SSH Port:

Type the following command to access SSH service using ssh and sftp commands from the default ssh port:

[root@centos-8 ~]# ssh root@centos-8.centlinux.com

Output will be:

ssh: connect to host centos-8.centlinux.com port 22: Connection refused

[root@centos-8 ~]# sftp root@centos-8.centlinux.com

ssh: connect to host centos-8.centlinux.com port 22: Connection refused

Connection closed.

Connection closed

The output above reveals that the Firewall is not allowing the traffic through port 22.

Access the SSH service by using ssh command:

[root@centos-8 ~]# ssh root@centos-8.centlinux.com -p 50

The authenticity of host '[centos-8.centlinux.com]:50 ([192.168.116.206]:50)' can't be established.

ECDSA key fingerprint is SHA256:skGj4xg0w+jIQtrfF8AOdfItgcXUQQu+bWUFfvws1Hk.

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added '[centos-8.centlinux.com]:50,[192.168.116.206]:50' (ECDSA) to the list of known hosts.

root@centos-8.centlinux.com's password:

Last login: Sat Aug  8 17:59:01 2020

[root@centos-8 ~]#

Similarly, for sftp:

[root@centos-8 ~]# sftp -P 50 root@centos-8.centlinux.com

root@centos-8.centlinux.com's password:

Connected to root@centos-8.centlinux.com.

sftp>

Congratulations! You made it to the end. If your looking to setup your very own SSD based CentOS VPS, your in the right place. Simply click on the link.

PS: Let us know how the tutorial worked for you in the comments below.