Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to listen to SSH on two ports: 22 for hosting admin access and 26 for regular access. I would like to disallow root login on 26 and disallow all but internal IPs for port 22. The latter can be done with iptables rules, but I don't know about the former. Any ideas?

share|improve this question
root should never be able to login via ssh; period; end of story; buck stops here; never. If you need root access then you login via your normal user, then elevate with su or better yet sudo. – Chris S Jun 27 '11 at 17:14
It's entirely okay to allow root logins over ssh if you restrict them to key authentication, or even password authentication if the session is restricted to IP addresses you control. 'Never' is too strong. – EightBitTony Jun 27 '11 at 17:24
I'd argue that there are situations where it makes sense to have a root login (e.g. Filesystem corruption on the /home partition, precluding login as a standard user). One thing that can help is to set the sshd_config PermitRootLogin parameter to without-password. This only allows root login via ssh to occur with an ssh key. Password authentication will not work. – ewwhite Jun 27 '11 at 17:29

In /etc/ssh/sshd_config, make the following change. Look for the line that says Port 22 and add a similar line under it.

Port 22
Port 26

Save the file and restart the sshd daemon.

I do this in situations where I have ssh enabled for internal users on port 22, but require external connectivity on say, port 2222. This binds the ssh daemon to both port numbers.

share|improve this answer
That's handy to know. – Iain Jun 27 '11 at 17:19
And how do you restrict root logins to port 22 now? – faker Jun 27 '11 at 18:12
@faker I've seen the use of firewall/network restrictions to only provide a whitelist of ip's access to regular port 22. – ThorSummoner Jun 24 '15 at 16:31

You can use the -f option to sshd to specify an alternate configuration file. In the configuration file you would need to use the

Port 26

directive to change the port that the sshd is listening on.


PermitRootLogin no

to disable root logins

You can then do something like

/usr/sbin/sshd -f /etc/ssh/sshd_config_port_26

You may want to copy the standard sshd startup script and modify them so that you can start the port 26 service at startup.

Why are you doing this ?

share|improve this answer

Assuming sshd will run with a command-line specific config file, then you could create a second config that runs on port 26 and execute a second start-up script that refers to that port.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.