LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   SSH and the changing ports it uses (https://www.linuxquestions.org/questions/linux-security-4/ssh-and-the-changing-ports-it-uses-528763/)

ille.pugil42 02-13-2007 03:22 PM

SSH and the changing ports it uses
 
Hi, I think I've figured this out, I'd just like some backup or affirmation here. (And yes, I did a search, just didn't find anything. That may have been because I didn't know the key words to look for). My /var/log/secure file has been showing ssh sessions at various times of the day, that in itself isn't that disconcerting since we've got more than 1 person that has to access it. The part that was kind of worrying was the fact that the port it was using was different each time. I think what is happening is that SSH is just either forwarding or using a different port for each connection. Is that the case? In testing that theory, I watched the log file (tail -f /var/log/secure) and proceeeded to log in via ssh 3 different times. The ports it used were 62274, 62275, 62276.

If anyone can affirm this as normal, that'd be great!

ilikejam 02-13-2007 03:50 PM

Hi.

Does the log look like:
Code:

Feb 11 21:20:01 cronus sshd[5030]: Accepted password for username from xxx.xxx.xxx.xxx port 1911 ssh2
?

If so, it's normal. The port referred to (1911 in this case) is the remote side's port, which will be random, and outside the privileged port range.

Dave

ille.pugil42 02-13-2007 05:22 PM

Yes, exactly! Thanks for affirming my theory.


All times are GMT -5. The time now is 08:49 PM.