Change default SSH port

stac00

Hi,

is it possible to change the ssh default port and make that change able to survive to sshd update.

When I modify /etc/ssh/sshd_config Port value, the file is reseted at next sshd update. Using specific /etc/ssh/sshd_config.d/example.conf file seems without effect. I suspect those file are not included in default configuration.

Thanks.

tjkreidl

@stac00 That's correct, it will not keep changes in the sshd_conf file.

Instead, create a dedicated folder for custom OpenSSH daemon overrides. Systemd reads this folder to layer your custom preferences on top of the default package configurations.bashmkdir -p /etc/systemd/system/sshd.service.d

Step 2: Write the Persistent Port OverrideCreate an override.conf file inside that new directory using nano:bashnano /etc/systemd/system/sshd.service.d/override.conf
Use code with caution.
Paste the following lines into the file (replace 2222 with your custom port number):ini[Service]
ExecStart=
ExecStart=/usr/sbin/sshd -D -p 2222 $OPTIONS
(Note: The blank ExecStart= line is required; it instructs systemd to clear out the default command entirely before applying your custom command).

Step 3: Update the Local Firewall (iptables)XCP-ng manages its firewall directly via iptables. You must insert a rule to accept traffic on the new port.bashiptables -I RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2222 -j ACCEPT
To ensure this rule survives host reboots, save the active rules:bashiptables-save > /etc/sysconfig/iptables
Use code with caution.Step 4: Reload and TestTell systemd to reload its daemon configurations, and then restart the SSH service:bashsystemctl daemon-reload
systemctl restart sshd
Crucial Safety Check: Do not disconnect your current console window. Open a completely new terminal on your local machine and test the connection string using your new port number:bashssh -p 2222 root@<your-xcp-ng-ip>
If you manage this host through an orchestrator, if you are using Xen Orchestra (XO) you may also need to update the custom management connection port inside your UI console.

I hope this helps. I have not attempted this myslef. so proceed with extreme caution! Again, be very careful to make sure it still works and is consistent everywhere it needs to be. The firewall rules are also critical.

poddingue

@tjkreidl's systemd override is the angle I would try first too, since it moves the port out of the file the package keeps rewriting and into a drop-in that an update should leave alone.

His firewall step is worth reading carefully rather than skimming, because on XCP-ng the iptables rule is the part that locks you out if you miss it, and he says himself he has not run this.

On your sshd_config.d question, I would check whether the shipped sshd_config actually contains an Include /etc/ssh/sshd_config.d/*.conf line, because if it does not then those files are simply never read and that would explain the silence rather completely.
One thing that is written down is that since 8.3 the accepted ciphers and algorithms are baked in at OpenSSH build time, and anything you override yourself is yours to maintain across updates: https://docs.xcp-ng.org/releases/release-8-3#openssh-security-ciphers-and-user-configuration.
Might be worth a mention to @Team-OS-Platform-Release, since whether a supported way to pin a port exists is really a packaging question rather than a config one.

I have not done this on a live host, so please keep a second session open while you test.