Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I altered the SSHD port on my unmanaged CentOS VPS to 0062, now I am unable to SSH in and get the error: Network error: connection refused.

Does anyone know how to get in and fix this? And why changing the port to this has stopped me from connecting?

Note: The VPS is hosted externally

share|improve this question
1  
Are you sure you changed both the firewall and the daemon? – David Schwartz May 8 '12 at 12:33
@DavidSchwartz I used centmin mod to perform the changes which said it performed all the necessary changes, I am not 100% positive but it sure did seem to change a lot. – George Reith May 8 '12 at 12:35
2  
Did you try to use nmap to look for opened port. Also on many languages having a number starting with 0 means it should be interpreted as octal, did you try then to connect to port 50 instead (62 in octal is 50 in decimal) – Huygens May 8 '12 at 12:38

4 Answers

up vote 2 down vote accepted

A number of things could of have happened. A few things come to mind:

  • Your firewall is still blocking the connection.
  • Another service is running on port 62
  • You did not restart the service after changing the value
  • ...

Try connecting via the out-of-band console (if you have one) and alter what needs to be changed (firewall, settings, ...). To test wether or not your firewall is bugging you, stop it for a little while and see if you can get in (service iptables stop)

I'm also not sure about putting 0062 as a port. You might need to put 62 instead.

If you are unable to get into the out-of-band, ask your provider to have a look. Otherwise, you will have to reimage the machine.

The script should indeed change both the port on the firewall and in the config for ssh:

sed -i 's/#HostKey \/etc\/ssh\/ssh_host_rsa_key/HostKey \/etc\/ssh\/ssh_host_rsa_key/g' /etc/ssh/sshd_config
sed -i 's/#HostKey \/etc\/ssh\/ssh_host_dsa_key/HostKey \/etc\/ssh\/ssh_host_dsa_key/g' /etc/ssh/sshd_config
sed -i 's/#PubkeyAuthentication/PubkeyAuthentication/g' /etc/ssh/sshd_config
sed -i 's/#RSAAuthentication/RSAAuthentication/g' /etc/ssh/sshd_config
sed -i 's/#AuthorizedKeysFile/AuthorizedKeysFile/g' /etc/ssh/sshd_config
sed -i 's/#IgnoreRhosts yes/IgnoreRhosts yes/g' /etc/ssh/sshd_config
sed -i 's/#PermitEmptyPasswords no/PermitEmptyPasswords no/g' /etc/ssh/sshd_config

/usr/sbin/sshd -t

service sshd restart

iptables -I INPUT -p tcp --dport $PORTNUM -j ACCEPT

service iptables restart

However, the 0062 might of have b0rked one or maybe both of them. Try getting back into your machine first.

share|improve this answer
I now realise I made an error with 0062 but I assume it would be read as 62, I used centmin mod to perform the change which said it successfully updated my firewall. I'm not sure what you mean by out-of-band console, I have a serial console on my VPS control panel however that is hardcoded to access via port 22. – George Reith May 8 '12 at 12:31
Isn't there a console you can use that doesn't rely on SSH? If you get in, please post the results for iptables -L -v -n and netstat -tulpen in your opening post. – Bart De Vos May 8 '12 at 12:34
up vote 3 down vote

0062 could be interpreted as octal...which would be port 50. Try connecting on port 50. I doubt it will work, but worth a try.

Who is the VPS hosted with? Most of them give you either a web console which doesn't connect via SSH, or at least a way to boot your system from a rescue CD where you could go in and change the config file.

share|improve this answer
1  
Unfortunately, it's also quite possible that some tools interpreted it as octal and some didn't. So the firewall and the daemon may not agree on the port. :( – David Schwartz May 8 '12 at 12:39
x10vps, I'm afraid port 50 didn't work but you did manage to get my hopes up for a second :). They provide a serial console in my VPS control panel but is seems hardwired on to port 22. – George Reith May 8 '12 at 12:46
You should be able to access the Serial Console, it's always hardwired to 22 because it doesn't listen to your ssh-server, but to an out-of-band-console on the host of your VPS. – Bart De Vos May 8 '12 at 13:01
@Bart De Vos you're right it was my java that was messing up. I managed to get in via serial console. I used the same script to set the port to 62 which had the same issue as before, but when I put back to 22 everything works as expected. I'm thinking I should perhaps just leave it at 22 and that added security through obscurity isn't THAT important. – George Reith May 8 '12 at 14:04
changing port numbers has a very low improvement on security. If you really want to lock down the server disable interactive password ssh logins and only allow SSH public/private key logins. That makes it so bots/hackers/etc cannot try brute force password breaking. – AlanBarber May 8 '12 at 17:01
up vote 2 down vote

If the the tips by others about firewall and netstat -tulpen output do not help you, there's yet another detail that can be wrong.

If SELinux is enabled, it can block sshd accessing ports other than 22. Check that out with

semanage port -l | grep ssh

Should that return only 22, you can add more ports to SELinux sshd rule with

semanage port -a -t ssh_port_t -p tcp 62
share|improve this answer
up vote 1 down vote

Did you specify the port when connecting to it via ssh? 

ssh -p 62 user@example.com

ssh expects to connect to port 22 by default and if you changed this, you need to tell your applications.

share|improve this answer
Yep, I am using PuTTY to SSH in on port 62 – George Reith May 8 '12 at 12:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.