From what I read (and experienced) so far, there are three main methods which can be used:
- change the setting in the ssh.plist file;
- change the setting in the /etc/services file;
- change the setting in the /etc/sshd.conf file.
Another way to do it, which I personally by far prefer to all and each of these methods, because it avoids messing around with Mac OS X system files is using socat to redirect port 22 to whichever port you want.
- Download socat: http://www.dest-unreach.org/socat/download/socat-126.96.36.199.tar.gz
- Move the tar.gz file to your /usr/local/ directory (
sudo mv ./socat-188.8.131.52.tar.gz /usr/local/socat-184.108.40.206.tar.gz)
- Go to your /usr/local directory (
sudo tar -xvzf socat-220.127.116.11.tar.gz
- Move to the uncompressed file directory:
- Run the usual configure, make and make install to install socat (
sudo ./configure && sudo make && sudo make install)
- Redirect port 22 (default ssh) to any port you want (in the following ex., 2222) using the correct option by sending a socat call (
sudo socat TCP-LISTEN:2222,reuseaddr,fork TCP:localhost:22)
You're done and your mac os x system files are left unchanged. In addition, this method works not only on Snow Leopard, but on all versions of Mac OS X and also on any machine on which socat may run.
The last thing you need to do if you use a router/firewall is to include the correct redirect commands in your router/firewall.
Also, it avoids getting stuck into the debate whether the ssh.plist method, the services method or the whatever method is better, more elegant or worse than the other.
You may also easily prepare a script that runs at start up to rebuild the socat redirection each you restart your machine. Place this in
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
sudo launchctl load -w /Library/LaunchDaemons/com.serverfault.sshdredirect.plist to load it. It'll automatically load on future reboots.
In addition, you can also improve security by (i) setting your firewall to block any connections to your port 22 from any other interface than the loopback (127.0.0.1) and (ii) make a similar change in your sshd.conf file to have ssh listen on the loopback only.