How to change sshd port on Mac OS X?

Question

I want to change sshd's port on Mac OS X from default 22 to 32, but editing /etc/sshd_config seems does not work.

How can I change it?

Answer 1

Every previous answer is working (as google suggest too), but it is dirty and inelegant.

The right way to change the listening port for a launchd handled service on Mac OS X is to use the dedicated keys available in launchd.plist manual.

So the solution is as simple as to use the port number instead of the service name:

    <key>Sockets</key>
    <dict>
            <key>Listeners</key>
            <dict>
                    <key>SockServiceName</key>
                    <string>22022</string>
                    <key>SockFamily</key>
                    <string>IPv4</string>
                    <key>Bonjour</key>
                    <array>
                            <string>22022</string>
                            <string>sftp-ssh</string>
                    </array>
            </dict>
    </dict>

The above will also force sshd to listen only over IPV4.

After making any changes to ssh.plist, the file must be reloaded as follows:

sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
sudo launchctl load /System/Library/LaunchDaemons/ssh.plist

Note that using launchctl stop ... and launchctl start ... will NOT reload this file.

Answer 2

In order to change the port on Mac OS-X for your SSH daemon, follow the following steps:

1. Open Terminal and as edit the file /etc/services (as root)

2. Add a line at the bottom:

   secret-ssh 43539/tcp # secret SSH port
   

3. Edit file /System/Library/LaunchDaemons/ssh.plist and replace the code:

   <key>SockServiceName </key>
   <string>ssh </string>
   

   with

   <key>SockServiceName </key>
   <string>secret-ssh </string>
   

4. Open Sharing control panel and ensure that Remote Login is checked off (if not uncheck it). Then check it again to start with the new configuration.

Now you should be able to run SSH command to your external IP as follows:

ssh -p 43539 ip_address_of_your_server -l username

Answer 3

If you want sshd to listen on an additional port, you can add multiple entries to the Sockets dictionary.

Example:

<key>Sockets</key>
<dict>
        <key>Listeners</key>
        <dict>
                <key>SockServiceName</key>
                <string>ssh</string>
                <key>Bonjour</key>
                <array>
                        <string>ssh</string>
                        <string>sftp-ssh</string>
                </array>
        </dict>
        <key>Listeners2</key>
        <dict>
                <key>SockServiceName</key>
                <string>22022</string>
        </dict>
</dict>

Answer 4

Better than all the options above, this is the easiest way to change your default SSH port in OS X.

I use this one-liner script in Terminal to update my Mac's default SSH Port:

read -p "Please enter new SSH Port number: " sshport; sudo sed -i "-bak" -n "/SockServiceName/{p;n;s/>.*</>$sshport</;};p" /System/Library/LaunchDaemons/ssh.plist; echo "SSH Port $sshport. Restart service for changes to take effect."

I can't take the credit, all kudos go to the Desert Crystal Tech Blog - OSX SSH Script here.

Answer 5

From what I read (and experienced) so far, there are three main methods which can be used:

1. change the setting in the ssh.plist file;

2. change the setting in the /etc/services file;

3. change the setting in the /etc/sshd.conf file.

Another way to do it, which I personally by far prefer to all and each of these methods, because it avoids messing around with Mac OS X system files is using socat to redirect port 22 to whichever port you want.

A. Download socat: hhttp://www.dest-unreach.org/socat/download/socat-1.7.1.3.tar.gz

B. Move the tar.gz file to your /usr/local/ directory (sudo mv ./socat-1.7.1.3.tar.gz /usr/local/socat-1.7.1.3.tar.gz)

C. Go to your /usr/local directory (cd /usr/local)

D. Uncompress: sudo tar -xvzf socat-1.7.1.3.tar.gz

E. Move to the uncompressed file directory: cd ./socat-1.7.1.3

F. Run the usual configure, make and make install to install socat (sudo ./configure && make && make install)

G. Redirect port 22 (default ssh) to any port you want (in the following ex., 2222) using the correct option by sending a socat call (socat tcp4-listen:2222,reuseaddr,fork TCP:localhost:22)

You're done and your mac os x system files are left unchanged. In addition, this method works not only on Snow Leopard, but on all versions of Mac OS X and also on any machine on which socat may run.

The last thing you need to do if you use a router/firewall is to include the correct redirect commands in your router/firewall.

Also, it avoids getting stuck into the debate whether the ssh.plist method, the services method or the whatever method is better, more elegant or worse than the other.

With a little research, you may also easily prepare a script that runs at start up to rebuild the socat redirection each you restart your machine;

In addition, you can also improve security by (i) setting your firewall to block any connections to your port 22 from any other interface than the loopback (127.0.0.1) and (ii) make a similar change in your sshd.conf file to have ssh listen on the loopback only.

Enjoy.

Answer 6

According to this hint you just need to change the port in /etc/services.

Answer 7

I couldn't see this documented anywhere properly in a man page, but if you want to do nothing more than add an extra listener, you can use an array of listeners and have an extra dict. This doesn't require editing /etc/services if you use the port directly (but remember to open up the port on your firewall!)

    <key>Listeners</key>
    <array>
    <dict>
        <key>Bonjour</key>
        <array>
            <string>ssh</string>
            <string>sftp-ssh</string>
        </array>
        <key>SockServiceName</key>
        <string>ssh</string>
    </dict>
    <dict>
        <key>SockServiceName</key>
        <string>22222</string>
    </dict>
    </array>