2

How do I change the ssh port to something other than 22 on Ubuntu Hardy?

2 Answers 2

3

Edit /etc/ssh/sshd_config and specify the port as Port 2222 (for example). Then restart the ssh daemon by running /etc/init.d/ssh restart.

Please note that this change will not improve your security! It is easy to check services mapped to ports. For example, if you change SSH port to 2222, and then run a port scan from another computer:

nmap -A testserver

you will get something like:

2222/tcp open  ssh      OpenSSH 5.1p1 Debian 6ubuntu2 (protocol 2.0)
|  ssh-hostkey: 1024 ba:e5:c3:42:f0:7d:9a:c5:f4:32:71:af:a5:f9:9c:b7 (DSA)
|_ 2048 bc:cf:68:f9:6f:8a:88:8f:7b:7a:b1:fa:5a:29:24:47 (RSA)

Edit: you may find useful the following article on SSH security practices: http://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html (#16, in particular).

2
  • Thanks. Is it possible to stop port scanning?
    – April
    Apr 2, 2010 at 2:44
  • Changing a port to a non-standard value (like 22 to 2222) will reduce the number of break-in attempts, because (I guess) simple hacker tools use standard ports. But this measure won't stop better tools or attackers. I think that a server can detect port scanning using IDS (Intrusion Detection System) or IPS (Intrusion Prevention System) and modifying firewall rules on the fly (blocking the attacker's IP). If attacks don't consume too much resources (and passwords are good), I wouldn't call it a critical issue. See: en.wikipedia.org/wiki/Intrusion_detection_system, snort.org Apr 5, 2010 at 10:43
3

Edit the port line in /etc/ssh/sshd_config and restart the ssh server (/etc/init.d/ssh restart)

1
  • This is what I did; none of my virtual servers accept connections on port 22 - I'd rather make the hackers play find-the-ssh-port.
    – PP.
    Mar 29, 2010 at 10:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .