Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I want to change my SSH port on CentOS.

But first I want to make sure the port is open before doing this.

Since SSH is the only way for me to access the server and I don't want to lock myself out :-)

I've used the following two commands to add an iptables rule:

iptables -I INPUT -p tcp --dport 4444 -j ACCEPT
/etc/init.d/iptables save

After that I've tested it with the following command:

nmap -v -sV localhost -p 4444

With the following result:

Host localhost.localdomain (127.0.0.1) appears to be up ... good.
Interesting ports on localhost.localdomain (127.0.0.1):
PORT     STATE  SERVICE VERSION
4444/tcp closed unknown

The state is closed so it looks like I haven't properly opened the port.

What should I do to open the port?

share|improve this question
Have you restart your iptables service? – garconcn Dec 2 '11 at 15:33
1  
Did you already change the port sshd listens on? If there's nothing listening on port 4444 it will appear closed to nmap. – mikkoko Dec 2 '11 at 15:39
@garconcn: I haven't restarted iptables. Is it needed? – PeeHaa 埽 Dec 2 '11 at 15:39
@mikkoko: are you sure about that? If I change the port of SSH and the iptables isn't yet properly set I lock myself out with no way of accessing the server. – PeeHaa 埽 Dec 2 '11 at 15:40
show 2 more comments

2 Answers

up vote 2 down vote accepted

The iptables command you used is right. Check netstat -anlp | grep 4444 to see if anything has that port open. My guess is your sshd is not listening on 4444 yet. Make sure if you've added 4444 to the sshd_config, that you've restarted sshd as well for the change to take effect.

share|improve this answer
is there a way to check if the port is already open before changing SSH port? Or are you sure I've correctly setup my iptables. Should I restart iptables as garconcn suggested? Thanks in advance! – PeeHaa 埽 Dec 2 '11 at 15:47
1  
By running that "iptables -I INPUT" command, you have added the rule to the top of your input ruleset. There's no "reloading" of iptables required, it's an instant change. And yes, I am absolutely sure that the command you ran will open TCP port 4444 inbound to the server in question. – Peter Grace♦ Dec 2 '11 at 15:49
netcat might help you test it (have it listen to the port, then connect to that port from another machine and see if you get the connection.) That way you don't lock yourself out. linux.com/learn/tutorials/… – Bart Silverstrim Dec 2 '11 at 15:58
up vote 1 down vote

Changing the port will not increase the security. You should disable in sshd_conf: root login authentication and password authentication. Use only ssh key based authentication.

To test your new port to see if it is reachable use netcat. Run: nc -l 4444 or netcat -l 4444 on the server, then test with nmap from the workstation.

share|improve this answer
Changing the port will not increase the security. You should disable in sshd_conf: root login authentication and password authentication. Use only ssh key based authentication. I know :) just want to keep my logs clean(er) – PeeHaa 埽 Dec 2 '11 at 15:48
3  
Changing the port does block out scripts and scans to standard ports. Denyhost can help block traffic too. It won't stop a targeted attack but it does make casual kiddies move along. – Bart Silverstrim Dec 2 '11 at 16:00
+1 for Denyhost. Great tool. – Tim Dec 2 '11 at 16:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.