3

UPDATE

As Khaled suggested, i changed my netstat command

netstat -lnp | grep 3899
tcp        0      0 :::3899           :::*              LISTEN      10333/sshd

So shouldn't it be listening?

I changed my ssh port on my centos 5.5 box to 3899. But I can't seem to login remotely to it. I have done this before but the last time, I didn't need to make any other changes to make it work.

iptables -L | grep 3899
[empty response]

iptables -L | grep 22
[empty response]

iptables -L | grep ssh
ACCEPT     tcp  --  anywhere       anywhere       state NEW tcp dpt:ssh
Improve this question

5 Answers 5

Reset to default
3

Yes, you probably need to adjust your firewall rules. To see your current rules:

iptables -nvL

If you see a bunch of ACCEPT rules and a REJECT rule at the end, that means your host is blocking all incoming connections except the specified ones.

I think you can use the system-config-securitylevel menu-based tool to open custom ports. Run that program in a terminal and choose the 'customize' button. Add 3899:tcp to the other ports list and save your changes. I'm not sure if system-config-securitylevel takes port numbers instead of service names. If specifying the port number in that tool doesn't work, you can try adding your custom 'myssh' service name to /etc/services and then using that name in system-config-securitylevel.

You can run

nmap -sS -v server.example.com

from an outside machine to scan your system to determine which ports are open.

Another way to make this change is to hand edit /etc/sysconfig/iptables, and copy the existing ssh entry to another entry right below it, but change the port from ssh to 3899. Note that it's easy to screw up your firewall config by hand-editing the iptables file, so be very cautious if you go this route. After you make changes, reboot the machine, or run /etc/init.d/iptables restart to load your changes.

Improve this answer
2
  • Thank you for the detailed answer. I never new about system-config-securitylevel. I changed the rule for 22 to 3899 in /etc/sysconfig/iptables and it works perfectly now. If your answer wasn't so detailed and generally helpful, I would have ignored it seeing that you asked me to reboot a linux machine =D
    – gAMBOOKa
    Feb 17, 2011 at 18:56
  • 'reboot the machine' is the simple answer, but note you can also use iptables -I chain num to insert rules in your running iptables without even flushing the existing rules. That's the maximum uptime solution, no reboot required. :)
    – Phil Hollenback
    Feb 17, 2011 at 19:03
2

run this and it should add entry to allow connecting to port 3899

iptables -I INPUT -p tcp --dport 3899 -j ACCEPT

your post does not show what is default policy for INPUT chain, or what other rules are.

copy paste here output of

iptables-save and netstat -nlp then we will know all the details needed to help you.

Improve this answer
0

The answer is probably yes -- If your iptables rules are active the destination port SSH (dpt:ssh) rule only covers port 22 -- the standard SSH port as assigned by IANA & listed in /etc/services.

You will need to change that rule to allow traffic to port 3899 (or whatever your new SSH port is) - On CentOS I believe the ipables rules are located in /etc/sysconfig/iptables

Improve this answer
0

  1. You need to make sure that SSH deamon is really listening on the new port using netstat -lnp | grep 3899.

  2. Also, you need to check your firewall settings. Allow the new port to pass through.

If you are getting a connection refused error, then you have a problem in point 1. If you are getting a connection timeout error, then you have a problem in point 2.

Improve this answer
1
  • Update answer with result
    – gAMBOOKa
    Feb 17, 2011 at 18:48
0

CentOS wil use port 22 regardless of the use of dpt:ssh You should manually open port 3899

You can do this by running this command:

iptables -I INPUT -p tcp --dport 3899 -j ACCEPT
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .