Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to change sshd's port on Mac OS X from default 22 to 32, but editing /etc/sshd_config seems does not work.

How can I change it?

share|improve this question

8 Answers 8

Every previous answer is working (as google suggest too), but they are dirty and inelegant.

The right way to change the listening port for a launchd handled service on Mac OS X is to make the changes the dedicated keys available in ssh.plist

So the solution is as simple as to use the port number instead of the service name.

An excerpt from my edited /System/Library/LaunchDaemons/ssh.plist:

    <key>Sockets</key>
    <dict>
            <key>Listeners</key>
            <dict>
                    <key>SockServiceName</key>
                    <string>22022</string>
                    <key>SockFamily</key>
                    <string>IPv4</string>
                    <key>Bonjour</key>
                    <array>
                            <string>22022</string>
                            <string>sftp-ssh</string>
                    </array>
            </dict>
    </dict>

The above will also force sshd to listen only over IPV4.

After making any changes to ssh.plist, the file must be reloaded as follows:

sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
sudo launchctl load /System/Library/LaunchDaemons/ssh.plist

Note that using launchctl stop ... and launchctl start ... will NOT reload this file.

The man page with more information can be found by typing man launchd.plist or using this link.

share|improve this answer
    
This is indeed elegant. Where does this launchd.plist get edited or saved to? –  Yar Apr 3 '11 at 13:54
2  
@Yar launchd.plist is the name of the manual. The change is in the ssh.plist file in /System/Library/LaunchDaemons –  Martijn Pieters Apr 20 '11 at 19:55
1  
I note that you need to either restart the machine, or restart the ssh service with launchctl. –  Danny Staple Dec 29 '11 at 8:31
    
It is also worth reading the other answers on this page to find out how to add multiple SSH ports and/or add named service ports (eg: secret-ssh), which combined with this answer seems like the "most elegant" way to add a port, and additionally should keep IPV6 working. –  cwd May 11 at 13:18
3  
Grr... every upgrade of OS X (Yosemite in this case) discards this change, requiring me to remember what I did the last time to fix it, and where I found this info. Thanks for the fix! –  Michael Nov 12 at 2:08

If you want sshd to listen on an additional port, you can add multiple entries to the Sockets dictionary.

Example:

<key>Sockets</key>
<dict>
        <key>Listeners</key>
        <dict>
                <key>SockServiceName</key>
                <string>ssh</string>
                <key>Bonjour</key>
                <array>
                        <string>ssh</string>
                        <string>sftp-ssh</string>
                </array>
        </dict>
        <key>Listeners2</key>
        <dict>
                <key>SockServiceName</key>
                <string>22022</string>
        </dict>
</dict>
share|improve this answer
1  
For clarity, @Raim is referring to: /System/Library/LaunchDaemons/ssh.plist –  Mike Causer Aug 26 '13 at 7:40

In order to change the port on Mac OS-X for your SSH daemon, follow the following steps:

  1. Open Terminal and as edit the file /etc/services (as root)
  2. Add a line at the bottom:

    secret-ssh 43539/tcp # secret SSH port
    
  3. Edit file /System/Library/LaunchDaemons/ssh.plist and replace the code:

    <key>SockServiceName </key>
    <string>ssh </string>
    

    with

    <key>SockServiceName </key>
    <string>secret-ssh </string>
    
  4. Open Sharing control panel and ensure that Remote Login is checked off (if not uncheck it). Then check it again to start with the new configuration.

Now you should be able to run SSH command to your external IP as follows:

ssh -p 43539 ip_address_of_your_server -l username
share|improve this answer
1  
very very dirty workaround –  AlberT Sep 22 '09 at 9:53
3  
@AlberT this may not be elegant but it includes enough instructions to get it working. –  Yar Apr 3 '11 at 14:36

Better than all the options above, this is the easiest way to change your default SSH port in OS X.

I use this one-liner script in Terminal to update my Mac's default SSH Port:

read -p "Please enter new SSH Port number: " sshport; sudo sed -i "-bak" -n "/SockServiceName/{p;n;s/>.*</>$sshport</;};p" /System/Library/LaunchDaemons/ssh.plist; echo "SSH Port $sshport. Restart service for changes to take effect."

I can't take the credit, all kudos go to the Desert Crystal Tech Blog - OSX SSH Script here.

share|improve this answer

From what I read (and experienced) so far, there are three main methods which can be used:

  1. change the setting in the ssh.plist file;
  2. change the setting in the /etc/services file;
  3. change the setting in the /etc/sshd.conf file.

Another way to do it, which I personally by far prefer to all and each of these methods, because it avoids messing around with Mac OS X system files is using socat to redirect port 22 to whichever port you want.

  1. Download socat: http://www.dest-unreach.org/socat/download/socat-1.7.1.3.tar.gz
  2. Move the tar.gz file to your /usr/local/ directory (sudo mv ./socat-1.7.1.3.tar.gz /usr/local/socat-1.7.1.3.tar.gz)
  3. Go to your /usr/local directory (cd /usr/local)
  4. Uncompress: sudo tar -xvzf socat-1.7.1.3.tar.gz
  5. Move to the uncompressed file directory: cd ./socat-1.7.1.3
  6. Run the usual configure, make and make install to install socat (sudo ./configure && make && make install)
  7. Redirect port 22 (default ssh) to any port you want (in the following ex., 2222) using the correct option by sending a socat call (socat TCP-LISTEN:2222,reuseaddr,fork TCP:localhost:22)

You're done and your mac os x system files are left unchanged. In addition, this method works not only on Snow Leopard, but on all versions of Mac OS X and also on any machine on which socat may run.

The last thing you need to do if you use a router/firewall is to include the correct redirect commands in your router/firewall.

Also, it avoids getting stuck into the debate whether the ssh.plist method, the services method or the whatever method is better, more elegant or worse than the other.

You may also easily prepare a script that runs at start up to rebuild the socat redirection each you restart your machine. Place this in /Library/LaunchDaemons/com.serverfault.sshdredirect.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.serverfault.sshdredirect</string>
    <key>KeepAlive</key>
    <dict>
        <key>NetworkState</key>
        <true/>
    </dict>
    <key>RunAtLoad</key>
    <true/>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/socat</string>
        <string>TCP-LISTEN:2224,reuseaddr,fork</string>
        <string>TCP:localhost:22</string>
    </array>
</dict>
</plist>

Use sudo launchctl load -w /Library/LaunchDaemons/com.serverfault.sshdredirect.plist to load it. It'll automatically load on future reboots.

In addition, you can also improve security by (i) setting your firewall to block any connections to your port 22 from any other interface than the loopback (127.0.0.1) and (ii) make a similar change in your sshd.conf file to have ssh listen on the loopback only.

Enjoy.

share|improve this answer
    
Editing the /etc/services file is a bad idea - it will affect things like SSH key login to your github or bitbucket accounts, which will seek to connect to the new port and fail. –  ccpizza May 31 at 0:23

According to this hint you just need to change the port in /etc/services.

share|improve this answer
4  
Ewww.... you would break applications that do a lookup on the 'ssh' service when they want to ssh into other hosts. Granted, by now port 22 is probably hardcoded but it just feels wrong. –  MikeyB Jun 24 '09 at 1:17

I couldn't see this documented anywhere properly in a man page, but if you want to do nothing more than add an extra listener, you can use an array of listeners and have an extra dict. This doesn't require editing /etc/services if you use the port directly (but remember to open up the port on your firewall!)

    <key>Listeners</key>
    <array>
    <dict>
        <key>Bonjour</key>
        <array>
            <string>ssh</string>
            <string>sftp-ssh</string>
        </array>
        <key>SockServiceName</key>
        <string>ssh</string>
    </dict>
    <dict>
        <key>SockServiceName</key>
        <string>22222</string>
    </dict>
    </array>
share|improve this answer

I was able to get this to work by just changing my SSH config file. It's actually a better solution to me because it's a change that applies to just the host I specify.

If you edit .ssh/config

sudo su
vim ~/.ssh/config

Add

Host CustomDomain
  Hostname 12.34.56.78
    Port 1000

Restart the shell and ssh that address.

ssh user@CustomDomain
share|improve this answer
    
you are talking about the ssh client, whereas the question is about the ssh server (sshd) listening port. –  ccpizza May 31 at 0:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.