35

I need to listen to SSH on two ports: 22 for hosting admin access and 26 for regular access. I would like to disallow root login on 26 and disallow all but internal IPs for port 22. The latter can be done with iptables rules, but I don't know about the former. Any ideas?

Improve this question
4
  • 3
    root should never be able to login via ssh; period; end of story; buck stops here; never. If you need root access then you login via your normal user, then elevate with su or better yet sudo.
    – Chris S
    Jun 27, 2011 at 17:14
  • 7
    It's entirely okay to allow root logins over ssh if you restrict them to key authentication, or even password authentication if the session is restricted to IP addresses you control. 'Never' is too strong.
    – EightBitTony
    Jun 27, 2011 at 17:24
  • 3
    I'd argue that there are situations where it makes sense to have a root login (e.g. Filesystem corruption on the /home partition, precluding login as a standard user). One thing that can help is to set the sshd_config PermitRootLogin parameter to without-password. This only allows root login via ssh to occur with an ssh key. Password authentication will not work.
    – ewwhite
    Jun 27, 2011 at 17:29
  • This article might be helpful: everythingsysadmin.com/2010/09/…
    – TomOnTime
    Jun 27, 2011 at 17:36

4 Answers 4

Reset to default
41

In /etc/ssh/sshd_config, make the following change. Look for the line that says Port 22 and add a similar line under it. 

Port 22
Port 26

Save the file and restart the sshd daemon.

I do this in situations where I have ssh enabled for internal users on port 22, but require external connectivity on say, port 2222. This binds the ssh daemon to both port numbers.

Improve this answer
3
  • 6
    And how do you restrict root logins to port 22 now?
    – faker
    Jun 27, 2011 at 18:12
  • @faker I've seen the use of firewall/network restrictions to only provide a whitelist of ip's access to regular port 22.
    – ThorSummoner
    Jun 24, 2015 at 16:31
  • 3
    Before restarting ssh use test mode sshd -t to check for any errors. @faker use PermitRootLogin prohibit-password (less-ambiguous synonym of 'without-password')
    – Pablo A
    Sep 24, 2020 at 6:39
13

You can use the -f option to sshd to specify an alternate configuration file. In the configuration file you would need to use the 

Port 26

directive to change the port that the sshd is listening on.

set 

PermitRootLogin no

to disable root logins

You can then do something like

/usr/sbin/sshd -f /etc/ssh/sshd_config_port_26

You may want to copy the standard sshd startup script and modify them so that you can start the port 26 service at startup.

Why are you doing this ?

Improve this answer
2
  • 3
    Instead of having two whole configuration files, if you wanted the servers to be otherwise essentially similar, wouldn't it be more straightforward and appropriate to just add -o PermitRootLogin yes -p 26
    – JamesTheAwesomeDude
    Mar 19, 2019 at 15:37
  • this is really a great way if you want to have an internal and external configuration, thanks
    – cinatic
    Sep 5, 2020 at 9:04
5

With a single sshd service, you could also set up your /etc/ssh/sshd_config file as follows:

First, make sure listening on both ports:

Port 22
Port 26

Second, use the Match keyword to change configuration depending on the port connecting on:

Match LocalPort 22
    PermitRootLogin yes

Match LocalPort 26
    PermitRootLogin no

Note: Match sections are typically placed at the end of /etc/ssh/sshd_config files as they override everything that comes before.

Improve this answer
3

Assuming sshd will run with a command-line specific config file, then you could create a second config that runs on port 26 and execute a second start-up script that refers to that port.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .