3

The server using CentOS 5.5

after changing default port in /etc/ssh/sshd_config, Im restarting SSH using command

/etc/init.d/sshd restart

and then I'm exit

exit

So Im testing connect SSH ssh -l root 123.456.789.123 and quickly get a message which showing the modification I make giving an effect:

ssh: connect to host 123.456.789.123 port 22: Connection refused

Im trying to connect with port:

ssh -p 12345 -l root 123.456.789.123

It takes too long time, and then fail to connect with message:

ssh: connect to host 123.456.789.123 port 12345: Connection timed out

I think something wrong with my command to connect to the port. Using
ssh -l root 123.456.789.123
quickly giving error
ssh: connect to host 123.456.789.123 port 22: Connection refused,
while using
ssh -p 22 -l root 123.456.789.123
takes too long time and failed to connect with message
ssh: connect to host 123.456.789.123 port 12345: Connection timed out

After reboot the server, this still happening

Improve this question

1 Answer 1

Reset to default
3

CentOS by default has the iptables firewall running. You probably need to open the new port for ssh.

Edit the file /etc/sysconfig/iptables and find the line (or similar)

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

change the 22 to the port number you have chosen for your sshd e.g. 

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 12345 -j ACCEPT

save the file and restart the iptables service

sudo service iptables restart

EDIT

Using iptables commands

Saved the current state of the firewall

sudo service iptables save

list the rule numbers for the RH-Firewall-1-INPUT table

sudo iptables -L RH-Firewall-1-INPUT  --line numbers

make a note of the line number for allowing ssh on port 22 on my system it's 12.

12   ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh

insert the new rule before the old one using for example port 12345

sudo iptables -I RH-Firewall-1-INPUT 12 -p tcp -m state --state NEW -m tcp --dport 12345 -j ACCEPT

Delete the old rule which will now be 1 higher than it was as the new rule went in before it but you can check by listing the line numbers like above.

sudo iptables  -D RH-Firewall-1-INPUT 13

save the new configuration

sudo service ipatbles save
Improve this answer
6
  • but I cannot login through SSH and I'm doing all things remotely. this is new server without anything installed
    – user56635
    Oct 9, 2010 at 15:14
  • You can't log in to the system at all now ?
    – user9517
    Oct 9, 2010 at 15:44
  • How was the server rebooted? Is there someone on site who can do the editing at the console?
    – Linker3000
    Oct 9, 2010 at 15:56
  • 1
    It may work, but /etc/sysconfig/iptables is NOT intended to be hand-edited. The correct way to change it is to modify you firewall using normal iptables commands, and then service iptables save.
    – Juliano
    Oct 9, 2010 at 16:12
  • @lain, yes.. except reboot the server through client dashboard and contact the support team
    – user56635
    Oct 9, 2010 at 16:46

You must log in to answer this question.