Moving Sshd Listen Port

Home » CentOS » Moving Sshd Listen Port
CentOS 17 Comments

I am having a problem getting sshd to run after changing it’s default port. I edit sshd_config and set the desired port, open it with firewall-cmd and then issue a systemctl start sshd. No error gets reported on the console but the following is logged in /var/messages

sshd.service: main process exited, code=exited, status%5/n/a

Not a very helpful error message. Sounds like I should report a bug?

Thanks, Mike

—–BEGIN PGP SIGNATURE—

17 thoughts on - Moving Sshd Listen Port

  • If you have SELinux enabled, it will block sshd from listening on a port other than what is described in the policy. You can add the additional port by running:

    semanage port -a -t ssh_port_t -p tcp $PORTNUM

    (replace $PORTNUM with the new port number you chose)

  • This was a “minimal” install for a virtual server and semanage is not available so the command doesn’t work…

    What package is semanage in?

    Mike

    —–BEGIN PGP SIGNATURE—

  • Did you update your IPTable? I change my SSHD port all the time. One of the first things I do on setting up a server. I know this is just obfusication, but it stops the robot noise. There are five steps:

    edit /etc/ssh/sshd_config edit IPtables add SSH policy for new port restart sshd restart iptables

  • Not using IPTables. Using firewalld and yes, I opened the new port there as well.

    Mike

  • Checking the firewall is useful, but it sounds like you can’t get the service to start in the first place.

    It might be helpful if you gave us the full error output. Do you get more information by running:

    systemctl status -l sshd.service

    … after running the systemctl start?

  • Hi Mike

    Can you run sshd manually in debugging mode and paste the output please:
    $ /usr/sbin/sshd -d

    It’s worth looking at the output of strace that may help here:
    $ strace /usr/sbin/sshd

    -V

  • Nothing more than what was in messages namely ‘code=exited, status%5/n/a’ which looks an awful lot like a printf of an uninitialized variable…

    Mike

  • /usr/sbin/sshd -d seems to work properly and accept connections at the new port. So does typing /usr/sbin/sshd, which daemonizes and runs manually. It now appears that it will not start as a service if I change the port, even after a reboot.

    Mike

  • Well, getenforce says enforcing but ‘systemctl status selinux’ says
    ‘Active: inactive (dead)’ ?

    Mike

  • Sounds like you have SELinux enabled. It’s not a service. If you look at the line right above the Active line you pasted, you’d see a line that said:
    “Loaded: not-found (Reason: No such file or directory)”

    It’ll say that about anything that doesn’t actually exist:

    # systemctl status selinux selinux.service
    Loaded: not-found (Reason: No such file or directory)
    Active: inactive (dead)

    # systemctl status asasdklfjhaskdfhj asasdklfjhaskdfhj.service
    Loaded: not-found (Reason: No such file or directory)
    Active: inactive (dead)

    I suggest installing the policycoreutils-python package and run the semanage command I mentioned earlier.