Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to change my SSH port on CentOS.

But first I want to make sure the port is open before doing this.

Since SSH is the only way for me to access the server and I don't want to lock myself out :-)

I've used the following two commands to add an iptables rule:

iptables -I INPUT -p tcp --dport 4444 -j ACCEPT
/etc/init.d/iptables save

After that I've tested it with the following command:

nmap -v -sV localhost -p 4444

With the following result:

Host localhost.localdomain (127.0.0.1) appears to be up ... good.
Interesting ports on localhost.localdomain (127.0.0.1):
PORT     STATE  SERVICE VERSION
4444/tcp closed unknown

The state is closed so it looks like I haven't properly opened the port.

What should I do to open the port?

share|improve this question
    
Have you restart your iptables service? –  garconcn Dec 2 '11 at 15:33
1  
Did you already change the port sshd listens on? If there's nothing listening on port 4444 it will appear closed to nmap. –  mikkoko Dec 2 '11 at 15:39
    
@garconcn: I haven't restarted iptables. Is it needed? –  PeeHaa Dec 2 '11 at 15:39
    
@mikkoko: are you sure about that? If I change the port of SSH and the iptables isn't yet properly set I lock myself out with no way of accessing the server. –  PeeHaa Dec 2 '11 at 15:40
    
serverfault.com/questions/116488/… –  quanta Dec 2 '11 at 15:45
show 2 more comments

2 Answers 2

up vote 2 down vote accepted

The iptables command you used is right. Check netstat -anlp | grep 4444 to see if anything has that port open. My guess is your sshd is not listening on 4444 yet. Make sure if you've added 4444 to the sshd_config, that you've restarted sshd as well for the change to take effect.

share|improve this answer
    
is there a way to check if the port is already open before changing SSH port? Or are you sure I've correctly setup my iptables. Should I restart iptables as garconcn suggested? Thanks in advance! –  PeeHaa Dec 2 '11 at 15:47
1  
By running that "iptables -I INPUT" command, you have added the rule to the top of your input ruleset. There's no "reloading" of iptables required, it's an instant change. And yes, I am absolutely sure that the command you ran will open TCP port 4444 inbound to the server in question. –  Peter Grace Dec 2 '11 at 15:49
    
netcat might help you test it (have it listen to the port, then connect to that port from another machine and see if you get the connection.) That way you don't lock yourself out. linux.com/learn/tutorials/… –  Bart Silverstrim Dec 2 '11 at 15:58
add comment

Changing the port will not increase the security. You should disable in sshd_conf: root login authentication and password authentication. Use only ssh key based authentication.

To test your new port to see if it is reachable use netcat. Run: nc -l 4444 or netcat -l 4444 on the server, then test with nmap from the workstation.

share|improve this answer
    
Changing the port will not increase the security. You should disable in sshd_conf: root login authentication and password authentication. Use only ssh key based authentication. I know :) just want to keep my logs clean(er) –  PeeHaa Dec 2 '11 at 15:48
3  
Changing the port does block out scripts and scans to standard ports. Denyhost can help block traffic too. It won't stop a targeted attack but it does make casual kiddies move along. –  Bart Silverstrim Dec 2 '11 at 16:00
    
+1 for Denyhost. Great tool. –  Tim Dec 2 '11 at 16:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.