How to change SSH port 22 to new one and make Linux system know the new SSH port?

sscn · 10-12-2016, 06:18 AM

Hello,

I want to mask one server SSH port 22 to another one and make the Linux know the new port to be assigned to SSH.

I added "Port 7890" to /etc/ssh/sshd_config file and restart the sshd service and the port 7890 can be used for SSH login.

However, when I use "nmap localhost" command, I cannot get ssh on the output list to link with port 7890.

How could I make the Linux system to know the new SSH port?

Thanks,

SSCN

jdkaye · 10-12-2016, 06:26 AM

Duckduckgo is your friend. A quick search will turn up a solution. Here's a good one
jdk

Turbocapitalist · 10-12-2016, 06:45 AM

If you can log in on the new port, then it is set up ok. That's the proof right there.

About the scans, which options, specifically, do you use with "nmap" to do the scan?

Usually for accurate results, you must do your scan from a second machine.

sscn · 10-12-2016, 07:15 AM

Hello jdkaye,

I tried it and I could use the new port for SSH login.

However, "nmap localhost" command still has no SSH service port info.

I want to know how to make SSH new port visible to nmap command.

Thanks a lot,

SSCN

sscn · 10-12-2016, 07:22 AM

Quote:

Originally Posted by Turbocapitalist

If you can log in on the new port, then it is set up ok. That's the proof right there.

About the scans, which options, specifically, do you use with "nmap" to do the scan?

Usually for accurate results, you must do your scan from a second machine.

"nmap localhost" didn't have ssh service info.

If I use 2252, nmap would show the port but system shows the port "unknow".

If I use 50683, nmap would not be able to show the port at all. So new SSH port is unknown to system.

sscn · 10-12-2016, 07:28 AM

"netstat -tulpn" could show sshd using the new port.

My question is how to make nmap to know new SSH port and display the info from the commmand "nmap localhost".

Thanks in advance,

SSCN

Emerson · 10-12-2016, 07:30 AM

Why using high ports for SSH is a bad idea.

michaelk · 10-12-2016, 07:34 AM

The output of the following command will scan all ports from the computer.
nmap -p 1-65536 localhost

If you see "7890/tcp open unknown" then ssh is working on the new port. The reason it outputs unknown is because there isn't anything defined for 7890 in /etc/services. It is not necessary to be listed in /etc/services to work. If a firewall is running on that computer you will need to add a rule to allow port 7890 TCP to access it remotely.

Turbocapitalist · 10-12-2016, 07:40 AM

Quote:

Originally Posted by sscn

"netstat -tulpn" could show sshd using the new port.

My question is how to make nmap to know new SSH port and display the info from the commmand "nmap localhost".

Thanks in advance,

SSCN

What do you have in the configuration file sshd_config regarding the Listen directive? If "sshd" is not listening on the address localhost, then your scan FROM localhost TO localhost with "nmap" won't find anything. Again, to us "nmap" correctly, you must run it from a second machine.

Even then, on a second machine, it is normal to tell "nmap" to do something by adding a few options.

Code:

nmap -A -T4 ssh.example.com

By the way, in addition to Emerson's link, there is this:
http://bsdly.blogspot.com/2013/02/th...igh-ports.html

sscn · 10-12-2016, 07:53 AM

Quote:

Originally Posted by Emerson

Why using high ports for SSH is a bad idea.

Thanks for the sharing.

The reason why I need to change SSH port to a new one is to avoid attack on the server as we did see enoumous connections to the server SSH port 22 when it was on line.

Our solution is to change the SSH port and bind the fixed IP for the server.

It seems that changing SSH port is not a good idea. Mask SSH port 22 or portknock is too complex.

I might need to study SSH public key authentication to enhance the secure access.

Thanks again.

sscn · 10-12-2016, 07:54 AM

Quote:

Originally Posted by michaelk

The output of the following command will scan all ports from the computer.
nmap -p 1-65536 localhost

If you see "7890/tcp open unknown" then ssh is working on the new port. The reason it outputs unknown is because there isn't anything defined for 7890 in /etc/services. It is not necessary to be listed in /etc/services to work. If a firewall is running on that computer you will need to add a rule to allow port 7890 TCP to access it remotely.

The command
nmap -p 1-65535 localhost
does work but not for "nmap -p 1-65536 localhost".

Thanks,

SSCN

sscn · 10-12-2016, 08:00 AM

Quote:

Originally Posted by michaelk

The output of the following command will scan all ports from the computer.
nmap -p 1-65536 localhost

If you see "7890/tcp open unknown" then ssh is working on the new port. The reason it outputs unknown is because there isn't anything defined for 7890 in /etc/services. It is not necessary to be listed in /etc/services to work. If a firewall is running on that computer you will need to add a rule to allow port 7890 TCP to access it remotely.

Do you know how to make /etc/services change valid after modification?

I did add new SSH port to the file but no luck even masked ssh port 22 lines.

Thanks,

SSCN

michaelk · 10-12-2016, 08:01 AM

Sorry that was a typo.

Turbocapitalist · 10-12-2016, 08:05 AM

Quote:

Originally Posted by sscn

The reason why I need to change SSH port to a new one is to avoid attack on the server as we did see enoumous connections to the server SSH port 22 when it was on line.

There are also tools like sshguard and fail2ban which will adjust your iptables rules to block some sources of some attacks.

michaelk · 10-12-2016, 08:31 AM

I'm having a bad morning... nmap has its own services file.

https://nmap.org/book/nmap-services.html