Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm failing to set-up an ssd on port 9922. With standard configuration on port 22 everything works fine. Then I change the port to 9922 by adding this line to ths sshd_config file:

Port 9922

I can connect to the server in the LAN on port 22 without prolems. After switching to port 9922 I get the following ouptput:

# ssh -vvv -p 9922 root@192.168.26.153
OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.26.153 [192.168.26.153] port 9922.
debug1: connect to address 192.168.26.153 port 9922: No route to host
ssh: connect to host 192.168.26.153 port 9922: No route to host
#

And nmap -p 9922 192.168.26.153 gives:

# nmap -p 9922 192.168.26.153

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2012-06-11 08:09 CEST
Interesting ports on 192.168.26.153:
PORT     STATE    SERVICE
9922/tcp filtered unknown
MAC Address: 4A:34:E7:11:9F:22 (Unknown)

Nmap finished: 1 IP address (1 host up) scanned in 0.184 seconds
#

Any ideas what's missing?

ifconfig on the target machines gives:

eth0      Link encap:Ethernet  Hardware Adresse 4A:34:E7:11:9F:22  
          inet Adresse:192.168.26.153  Bcast:192.168.26.255  Maske:255.255.255.0
          inet6 Adresse: fe80::4834:e7ff:fe11:9f22/64 G?ltigkeitsbereich:Verbindung
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2723010 errors:0 dropped:0 overruns:0 frame:0
          TX packets:552 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenl?nge:1000 
          RX bytes:561183811 (535.1 MiB)  TX bytes:52703 (51.4 KiB)
          Interrupt:24 

lo        Link encap:Lokale Schleife  
          inet Adresse:127.0.0.1  Maske:255.0.0.0
          inet6 Adresse: ::1/128 G?ltigkeitsbereich:Maschine
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenl?nge:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

And route -n:

# route -n
Kernel IP Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
192.168.10.0    192.168.26.1    255.255.255.0   UG    0      0        0 eth0
192.168.26.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
0.0.0.0         192.168.26.4    0.0.0.0         UG    0      0        0 eth0
# 

iptables -L returns:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
# 
share|improve this question
    
Is the firewall at 192.168.26.153 configured to allow incoming connections to 9922? –  Hex Jun 11 '12 at 5:45
    
It's a vanilla CentOs 6.2 installation. I did not set-up a firewall. Is there something set-up by default? –  BetaRide Jun 11 '12 at 5:50
    
"No route to host" says it all. Your network interface and/or your routing table can not find a route for the target address. What's the result of ifconfig and route -n? –  ripat Jun 11 '12 at 6:05
2  
check if there are default rules "iptables -L" . Make sure if you can see the server by "ping 192.168.26.153" –  Hex Jun 11 '12 at 6:25
2  
Woa, I was sure it was that :) I missed this part in your previews message: REJECT all -- anywhere anywhere reject-with icmp-host-pro This was what have blocked your traffic –  Hex Jun 11 '12 at 6:34
show 4 more comments

3 Answers

up vote 2 down vote accepted

While it is not a smart idea to stop the firewall i would propose to start the firewall and allow incomming port 9922 by

/sbin/iptables -A INPUT -p tcp --dport 9922 -j ACCEPT

share|improve this answer
    
Yes, of course. Stopping it was just a quick test. –  BetaRide Jun 11 '12 at 7:34
add comment

You must likely have SELinux enabled at your server. If you don't need it, disable it temporarily with setenforce 0 or permanently by modifying /etc/selinux/config file.

If you want to use SELinux, make it allow sshd to bind to port 9922:

semanage port -a -t ssh_port_t -p tcp 9922
share|improve this answer
add comment

You can have multiple Port lines in your sshd.conf, e.g.

Port 22
Port 2222
#Protocol 2,1
Protocol 2
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

I typically do this because I'll have an external firewall/NAT open on the alternative port, but will want internal systems to hit the server on the traditional port 22.

Please make sure you restart the ssh daemon (service sshd restart) following any configuration file changes.

What happens if you nmap -p 9922 192.168.26.153? Does it show the port open?

The error in your ssh client debug output should be "Connection timed out" instead of "No route to host". What's in between you and the target system?

share|improve this answer
    
There's nothing between the two machines. They are in the same LAN. –  BetaRide Jun 11 '12 at 6:08
    
Did you restart the ssh daemon? The nmap output indicates that it's not listening on the preferred port. netstat -anp | grep sshd on the target server would confirm this. –  ewwhite Jun 11 '12 at 6:23
    
Yes, I did. And I can confirm that sshd is running and listening on port 9922. –  BetaRide Jun 11 '12 at 6:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.