How do I change the port for SSH

Security
1

I have a small question regarding SSH
How do I change the port for ssh and allow the new port in firewalld. How do I then close the old port 22 in firewalld?

Kind regards

2
  • The sshd’s config obviously is the place where you set the port that the sshd process does listen
  • It might be necessary to tell the SELinux to allow the sshd process to listen that port
  • The FirewallD’s default config has set the zone ‘public’ to have service ‘ssh’, and the config of that service is set to allow port 22. It should be possible to modify the service, or replicate with different port. Either by firewall-cmd or with files in /etc/firewalld/*. See Configuring firewalls and packet filters Red Hat Enterprise Linux 9 | Red Hat Customer Portal
3

How to configure SSH to use a non-standard port with SELinux set to enforcing | TechRepublic is another one that gives instructions for the ssh port and firewall.

1 Like
4

That says sudo nano /etc/ssh/sshd_config

Fine for el8, but el9 has a new shiny:
sudo nano /etc/ssh/sshd_config.d/00-myport.conf

The statements in /etc/ssh/sshd_config.d/00-myport.conf do override statements
in /etc/ssh/sshd_config and you can later easily see what customizations you
have done, rather than asking “What did I edit in /etc/ssh/sshd_config?”

2 Likes
5

Ah, thanks for that. As the one Alma I’m using regularly is on an older machine that won’t take Alma9, I wasn’t aware of that. (My other installs are on laptops or vms, where I haven’t tried to change the default port). So, I learned something this morning, thanks to you. :slight_smile:

6

Used me of these two commands for when I changed the gate in the file sshd_config

semanage port -a -t ssh_port_t -p tcp 2021

Semanage port -m -t ssh_port_t -p tcp 2021

Then I restarted the service for firewalld

sudo systemctl restart firewalld

Then it worked great.

By the way, how do I Put this post as solved?

7

This is “for the record”.

The following description is in the /etc/ssh/sshd_config file for el9:

# To modify the system-wide sshd configuration, create a  *.conf  file under
#  /etc/ssh/sshd_config.d/  which will be automatically included below
Include /etc/ssh/sshd_config.d/*.conf

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER