Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
1

How do I change the ssh port to something other than 22 on Ubuntu Hardy?

share|improve this question

2 Answers

up vote 3 down vote accepted

Edit /etc/ssh/sshd_config and specify the port as Port 2222 (for example). Then restart the ssh daemon by running /etc/init.d/ssh restart.

Please note that this change will not improve your security! It is easy to check services mapped to ports. For example, if you change SSH port to 2222, and then run a port scan from another computer:

nmap -A testserver

you will get something like:

2222/tcp open  ssh      OpenSSH 5.1p1 Debian 6ubuntu2 (protocol 2.0)
|  ssh-hostkey: 1024 ba:e5:c3:42:f0:7d:9a:c5:f4:32:71:af:a5:f9:9c:b7 (DSA)
|_ 2048 bc:cf:68:f9:6f:8a:88:8f:7b:7a:b1:fa:5a:29:24:47 (RSA)

Edit: you may find useful the following article on SSH security practices: http://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html (#16, in particular).

share|improve this answer
Thanks. Is it possible to stop port scanning? – April Apr 2 '10 at 2:44
Changing a port to a non-standard value (like 22 to 2222) will reduce the number of break-in attempts, because (I guess) simple hacker tools use standard ports. But this measure won't stop better tools or attackers. I think that a server can detect port scanning using IDS (Intrusion Detection System) or IPS (Intrusion Prevention System) and modifying firewall rules on the fly (blocking the attacker's IP). If attacks don't consume too much resources (and passwords are good), I wouldn't call it a critical issue. See: en.wikipedia.org/wiki/Intrusion_detection_system, snort.org – Igor Kuzmitshov Apr 5 '10 at 10:43
up vote 4 down vote

Edit the port line in /etc/ssh/sshd_config and restart the ssh server (/etc/init.d/ssh restart)

share|improve this answer
This is what I did; none of my virtual servers accept connections on port 22 - I'd rather make the hackers play find-the-ssh-port. – PP. Mar 29 '10 at 10:18
Thanks for this. – April Apr 2 '10 at 2:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.