I need to listen to SSH on two ports: 22 for hosting admin access and 26 for regular access. I would like to disallow root login on 26 and disallow all but internal IPs for port 22. The latter can be done with iptables rules, but I don't know about the former. Any ideas?
4 Answers
In /etc/ssh/sshd_config
, make the following change. Look for the line that says Port 22
and add a similar line under it.
Port 22
Port 26
Save the file and restart the sshd daemon.
I do this in situations where I have ssh enabled for internal users on port 22, but require external connectivity on say, port 2222. This binds the ssh daemon to both port numbers.
-
6
-
@faker I've seen the use of firewall/network restrictions to only provide a whitelist of ip's access to regular port 22. Jun 24, 2015 at 16:31
-
3Before restarting ssh use test mode
sshd -t
to check for any errors. @faker usePermitRootLogin prohibit-password
(less-ambiguous synonym of 'without-password')– Pablo ASep 24, 2020 at 6:39
You can use the -f
option to sshd to specify an alternate configuration file. In the configuration file you would need to use the
Port 26
directive to change the port that the sshd is listening on.
set
PermitRootLogin no
to disable root logins
You can then do something like
/usr/sbin/sshd -f /etc/ssh/sshd_config_port_26
You may want to copy the standard sshd startup script and modify them so that you can start the port 26 service at startup.
Why are you doing this ?
-
3Instead of having two whole configuration files, if you wanted the servers to be otherwise essentially similar, wouldn't it be more straightforward and appropriate to just add
-o PermitRootLogin yes -p 26
Mar 19, 2019 at 15:37 -
this is really a great way if you want to have an
internal
andexternal
configuration, thanks– cinaticSep 5, 2020 at 9:04
With a single sshd service, you could also set up your /etc/ssh/sshd_config
file as follows:
First, make sure listening on both ports:
Port 22
Port 26
Second, use the Match keyword to change configuration depending on the port connecting on:
Match LocalPort 22
PermitRootLogin yes
Match LocalPort 26
PermitRootLogin no
Note: Match sections are typically placed at the end of /etc/ssh/sshd_config
files as they override everything that comes before.
Assuming sshd will run with a command-line specific config file, then you could create a second config that runs on port 26 and execute a second start-up script that refers to that port.
su
or better yetsudo
.PermitRootLogin
parameter towithout-password
. This only allows root login via ssh to occur with an ssh key. Password authentication will not work.