Change default SSH port
-
Hi,
is it possible to change the ssh default port and make that change able to survive to sshd update.
When I modify /etc/ssh/sshd_config Port value, the file is reseted at next sshd update. Using specific /etc/ssh/sshd_config.d/example.conf file seems without effect. I suspect those file are not included in default configuration.
Thanks.
-
S stac00 crossposted this topic to Platform
-
@stac00 That's correct, it will not keep changes in the sshd_conf file.
Instead, create a dedicated folder for custom OpenSSH daemon overrides. Systemd reads this folder to layer your custom preferences on top of the default package configurations.bashmkdir -p /etc/systemd/system/sshd.service.d
Step 2: Write the Persistent Port OverrideCreate an override.conf file inside that new directory using nano:bashnano /etc/systemd/system/sshd.service.d/override.conf
Use code with caution.
Paste the following lines into the file (replace 2222 with your custom port number):ini[Service]
ExecStart=
ExecStart=/usr/sbin/sshd -D -p 2222 $OPTIONS
(Note: The blank ExecStart= line is required; it instructs systemd to clear out the default command entirely before applying your custom command).Step 3: Update the Local Firewall (iptables)XCP-ng manages its firewall directly via iptables. You must insert a rule to accept traffic on the new port.bashiptables -I RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 2222 -j ACCEPT
To ensure this rule survives host reboots, save the active rules:bashiptables-save > /etc/sysconfig/iptables
Use code with caution.Step 4: Reload and TestTell systemd to reload its daemon configurations, and then restart the SSH service:bashsystemctl daemon-reload
systemctl restart sshd
Crucial Safety Check: Do not disconnect your current console window. Open a completely new terminal on your local machine and test the connection string using your new port number:bashssh -p 2222 root@<your-xcp-ng-ip>
If you manage this host through an orchestrator, if you are using Xen Orchestra (XO) you may also need to update the custom management connection port inside your UI console.I hope this helps. I have not attempted this myslef. so proceed with extreme caution! Again, be very careful to make sure it still works and is consistent everywhere it needs to be. The firewall rules are also critical.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login