Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to change which port sshd uses on a Mac server. For example, let's say from port 22 to port 32.

Editing /etc/sshd_config does not seem to work. Does anyone know how to change it? I'd prefer a method that's compatible with all OSX versions (or as many as possible, at least).

share|improve this question
    
Also note that /usr/libexec/sshd-keygen-wrapper (shown in the plists below) can start a different SSH than specified in the plist itself. If you cat it, it always starts /usr/sbin/sshd. –  jww Aug 22 at 0:22

4 Answers 4

Every previous answer is working (as google suggest too), but they are dirty and inelegant.

The right way to change the listening port for a launchd handled service on Mac OS X is to make the changes the dedicated keys available in ssh.plist

So the solution is as simple as to use the port number instead of the service name.

An excerpt from my edited /System/Library/LaunchDaemons/ssh.plist:

    <key>Sockets</key>
    <dict>
            <key>Listeners</key>
            <dict>
                    <key>SockServiceName</key>
                    <string>22022</string>
                    <key>SockFamily</key>
                    <string>IPv4</string>
                    <key>Bonjour</key>
                    <array>
                            <string>22022</string>
                    </array>
            </dict>
    </dict>

The above will also force sshd to listen only over IPV4.

After making any changes to ssh.plist, the file must be reloaded as follows:

sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
sudo launchctl load /System/Library/LaunchDaemons/ssh.plist

Note that using launchctl stop ... and launchctl start ... will NOT reload this file.

The man page with more information can be found by typing man launchd.plist or using this link.

share|improve this answer
    
This is indeed elegant. Where does this launchd.plist get edited or saved to? –  Yar Apr 3 '11 at 13:54
3  
@Yar launchd.plist is the name of the manual. The change is in the ssh.plist file in /System/Library/LaunchDaemons –  Martijn Pieters Apr 20 '11 at 19:55
1  
I note that you need to either restart the machine, or restart the ssh service with launchctl. –  Danny Staple Dec 29 '11 at 8:31
3  
Grr... every upgrade of OS X (Yosemite in this case) discards this change, requiring me to remember what I did the last time to fix it, and where I found this info. Thanks for the fix! –  Michael Nov 12 '14 at 2:08
1  
@Hassan you have to start two ssh instances .. i.e. add another Listener with different SockServiceName name and value –  AlberT Feb 26 at 17:49

If you want sshd to listen on an additional port, you can add multiple entries to the Sockets dictionary.

Example:

<key>Sockets</key>
<dict>
        <key>Listeners</key>
        <dict>
                <key>SockServiceName</key>
                <string>ssh</string>
                <key>Bonjour</key>
                <array>
                        <string>ssh</string>
                        <string>sftp-ssh</string>
                </array>
        </dict>
        <key>Listeners2</key>
        <dict>
                <key>SockServiceName</key>
                <string>22022</string>
        </dict>
</dict>
share|improve this answer
1  
For clarity, @Raim is referring to: /System/Library/LaunchDaemons/ssh.plist –  Mike Causer Aug 26 '13 at 7:40

From what I read (and experienced) so far, there are three main methods which can be used:

  1. change the setting in the ssh.plist file;
  2. change the setting in the /etc/services file;
  3. change the setting in the /etc/sshd.conf file.

Another way to do it, which I personally by far prefer to all and each of these methods, because it avoids messing around with Mac OS X system files is using socat to redirect port 22 to whichever port you want.

  1. Download socat: http://www.dest-unreach.org/socat/download/socat-1.7.1.3.tar.gz
  2. Move the tar.gz file to your /usr/local/ directory (sudo mv ./socat-1.7.1.3.tar.gz /usr/local/socat-1.7.1.3.tar.gz)
  3. Go to your /usr/local directory (cd /usr/local)
  4. Uncompress: sudo tar -xvzf socat-1.7.1.3.tar.gz
  5. Move to the uncompressed file directory: cd ./socat-1.7.1.3
  6. Run the usual configure, make and make install to install socat (sudo ./configure && sudo make && sudo make install)
  7. Redirect port 22 (default ssh) to any port you want (in the following ex., 2222) using the correct option by sending a socat call (sudo socat TCP-LISTEN:2222,reuseaddr,fork TCP:localhost:22)

You're done and your mac os x system files are left unchanged. In addition, this method works not only on Snow Leopard, but on all versions of Mac OS X and also on any machine on which socat may run.

The last thing you need to do if you use a router/firewall is to include the correct redirect commands in your router/firewall.

Also, it avoids getting stuck into the debate whether the ssh.plist method, the services method or the whatever method is better, more elegant or worse than the other.

You may also easily prepare a script that runs at start up to rebuild the socat redirection each you restart your machine. Place this in /Library/LaunchDaemons/com.serverfault.sshdredirect.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.serverfault.sshdredirect</string>
    <key>KeepAlive</key>
    <dict>
        <key>NetworkState</key>
        <true/>
    </dict>
    <key>RunAtLoad</key>
    <true/>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/socat</string>
        <string>TCP-LISTEN:2224,reuseaddr,fork</string>
        <string>TCP:localhost:22</string>
    </array>
</dict>
</plist>

Use sudo launchctl load -w /Library/LaunchDaemons/com.serverfault.sshdredirect.plist to load it. It'll automatically load on future reboots.

In addition, you can also improve security by (i) setting your firewall to block any connections to your port 22 from any other interface than the loopback (127.0.0.1) and (ii) make a similar change in your sshd.conf file to have ssh listen on the loopback only.

Enjoy.

share|improve this answer
1  
Editing the /etc/services file is a bad idea - it will affect things like SSH key login to your github or bitbucket accounts, which will seek to connect to the new port and fail. –  ccpizza May 31 '14 at 0:23
    
You should build in a scratch directory. Then use sudo to install. You should not build with elevated privileges. –  jww Aug 22 at 22:37

I couldn't see this documented anywhere properly in a man page, but if you want to do nothing more than add an extra listener, you can use an array of listeners and have an extra dict. This doesn't require editing /etc/services if you use the port directly (but remember to open up the port on your firewall!)

    <key>Listeners</key>
    <array>
    <dict>
        <key>Bonjour</key>
        <array>
            <string>ssh</string>
            <string>sftp-ssh</string>
        </array>
        <key>SockServiceName</key>
        <string>ssh</string>
    </dict>
    <dict>
        <key>SockServiceName</key>
        <string>22222</string>
    </dict>
    </array>
share|improve this answer

protected by Community Feb 20 at 4:25

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.