Change default SSH port

stac00

Hi,

is it possible to change the ssh default port and make that change able to survive to sshd update.

When I modify /etc/ssh/sshd_config Port value, the file is reseted at next sshd update. Using specific /etc/ssh/sshd_config.d/example.conf file seems without effect. I suspect those file are not included in default configuration.

Thanks.

tjkreidl

@stac00 That's correct, it will not keep changes in the sshd_conf file.

Instead,
Step 1: Create a dedicated folder for custom OpenSSH daemon overrides. Systemd reads this folder to layer your custom preferences on top of the default package configurations.bashmkdir -p /etc/systemd/system/sshd.service.d

Step 2: Write the Persistent Port OverrideCreate an override.conf file inside that new directory using nano:bashnano /etc/systemd/system/sshd.service.d/override.conf
Use code with caution.
Paste the following lines into the file (replace 2222 with your custom port number):ini[Service]
ExecStart=
ExecStart=/usr/sbin/sshd -D -p 2222 $OPTIONS
(Note: The blank ExecStart= line is required; it instructs systemd to clear out the default command entirely before applying your custom command).

Step 3: Update the Local Firewall (iptables)XCP-ng manages its firewall directly via iptables. You must insert a rule to accept traffic on the new port.bashiptables -I RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2222 -j ACCEPT
To ensure this rule survives host reboots, save the active rules:bashiptables-save > /etc/sysconfig/iptables
Use code with caution.Step 4: Reload and TestTell systemd to reload its daemon configurations, and then restart the SSH service:bashsystemctl daemon-reload
systemctl restart sshd
Crucial Safety Check: Do not disconnect your current console window. Open a completely new terminal on your local machine and test the connection string using your new port number:bashssh -p 2222 root@<your-xcp-ng-ip>
If you manage this host through an orchestrator, if you are using Xen Orchestra (XO) you may also need to update the custom management connection port inside your UI console.

I hope this helps. I have not attempted this myself. so proceed with extreme caution! Again, be very careful to make sure it still works and is consistent everywhere it needs to be. The firewall rules are also critical.

poddingue

@tjkreidl's systemd override is the angle I would try first too, since it moves the port out of the file the package keeps rewriting and into a drop-in that an update should leave alone.

His firewall step is worth reading carefully rather than skimming, because on XCP-ng the iptables rule is the part that locks you out if you miss it, and he says himself he has not run this.

On your sshd_config.d question, I would check whether the shipped sshd_config actually contains an Include /etc/ssh/sshd_config.d/*.conf line, because if it does not then those files are simply never read and that would explain the silence rather completely.
One thing that is written down is that since 8.3 the accepted ciphers and algorithms are baked in at OpenSSH build time, and anything you override yourself is yours to maintain across updates: https://docs.xcp-ng.org/releases/release-8-3#openssh-security-ciphers-and-user-configuration.
Might be worth a mention to @Team-OS-Platform-Release, since whether a supported way to pin a port exists is really a packaging question rather than a config one.

I have not done this on a live host, so please keep a second session open while you test.

poddingue

I checked this on an 8.3 host here, and your sshd_config.d observation is exactly right: the shipped /etc/ssh/sshd_config has no Include line at all, so anything you drop in that directory is never read.
The directory exists and is empty, which is what makes it look like it should work. It is not an OpenSSH version limit either, since the package is openssh-server-9.8p1-1.2.4.xcpng8.3 and 9.8 supports Include fine.
On @tjkreidl's route, two things check out on my side: the packaged unit really is ExecStart=/usr/sbin/sshd -D $OPTIONS, so his blank ExecStart= plus a replacement line is the correct shape, and RH-Firewall-1-INPUT does exist as a chain, so his iptables step targets the right place.
I have not actually moved a port with it, so treat that as "the pieces line up" rather than "I tested it end to end", and keep a second session open when you try.
Might be worth a mention to @Team-OS-Platform-Release, since whether there is a supported way to pin a port is a packaging question more than a config one.

tjkreidl

@poddingue The other option would be to be able to offer a different default /etc/ssh/sshd_config option but that's embedded in the Linux OS.
One other possibility would be to create a startup job that runs out of /etc/rc.local and has a script that makes the changes after-the-fact. Just a thought...