-2

I've added the line "Port 110" in /etc/ssh/sshd_config just bellow the existing line "Port 22" and then did an /etc/init.d/sshd restart expecting to see sshd listening on both ports (22 and 110). However netstat -anp showed that sshd was only listening to the default port (22).

Later I tried bash -x /etc/init.d/sshd restart and was amazed to see sshd bind to port 110 immediately!!! Issuing a second /etc/init.d/sshd restart again ignored my change. Rebooting also ignores my change so I'm stuck and utterly puzzled.

UPDATE this strange behaviour appears only on low ports (<1024)

This is on a CentOS 6 server.

Details

Here is my modification to /etc/ssh/sshd_config:

grep ^Port /etc/ssh/sshd_config
Port 22
Port 110

Output of netstat after bash -x /etc/init.d/sshd restart

netstat -anp | grep -i listen|grep sshd|grep -v :::
tcp        0      0 0.0.0.0:110                 0.0.0.0:*                   LISTEN      7031/sshd           
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      7031/sshd

Output of netstat after /etc/init.d/sshd restart

netstat -anp | grep -i listen|grep sshd|grep -v :::
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      8962/sshd

Another way to convince sshd to bind to port 110 is by running it in debug mode with /usr/sbin/sshd -de (note the listening on port 22,110 lines but I've also tested by connecting to both ports):

/usr/sbin/sshd -de
debug1: sshd version OpenSSH_5.3p1
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-de'
Set /proc/self/oom_score_adj from 0 to -1000
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Bind to port 22 on ::.
Server listening on :: port 22.
debug1: Bind to port 110 on 0.0.0.0.
Server listening on 0.0.0.0 port 110.
debug1: Bind to port 110 on ::.
Server listening on :: port 110.
Improve this question
10
  • Port 110 is the default port for POP3, are you sure there is no mailsystem running on the server as well that might try to claim the port simultaneously?
    – Oldskool
    Mar 3, 2015 at 10:58
  • Yes absolutely sure. Note however that if anything like that was the problem bash -x would make zero difference. In fact it's crazy that it does make a very big difference in this case.
    – ndemou
    Mar 3, 2015 at 11:01
  • have you tried adding a 'set -x' to the top of the sshd init script to simulate the same effect and see if you get any more info?
    – Martin
    Mar 3, 2015 at 18:09
  • Good idea Martin! But I tried it and it makes no difference!!! I only get the expected behaviour when I manually run the sshd script with bash -x!!!
    – ndemou
    Mar 3, 2015 at 19:02
  • 2
    Is SELinux enabled?
    – user9517
    Mar 3, 2015 at 21:43

1 Answer 1

Reset to default
6

The SELinux system is restricting the port binding for ports below 1024

semanage port -l | grep ssh
ssh_port_t                     tcp      22

You can add another port 

semanage port -a -t ssh_port_t -p tcp 110

That would fix you immediate problem.

Improve this answer
5
  • Thanks Iain! Any thoughts on why restarting with bash -x bypasses SELinux's restriction (which from a security perspective is quite troubling).
    – ndemou
    Mar 4, 2015 at 7:52
  • @ndemou the -x is a red herring it 'works' without it too. I've asked someone who is much more knowledgeable about it.
    – user9517
    Mar 4, 2015 at 8:33
  • What a disappointment then, SELinux makes my life miserable WITHOUT succeeding in enforcing the rules... :(
    – ndemou
    Mar 4, 2015 at 12:02
  • 3
    If you run the init script directly, then the domain transitions to initrc_t and then further to sshd_t. If you call it from a bash subshell, the transition doesn't take place and it runs unconfined.
    – Michael Hampton
    Mar 4, 2015 at 19:34
  • 1
    And if the above command fails with "semanage: Port tcp/110 already defined" you must use semanage port -m -t ssh_port_t -p tcp 110 (see man semanage)
    – ndemou
    Sep 27, 2016 at 11:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .