How to reject HTTP access to SSH port

Question

I changed my server SSH port to something else than port 22, however when I access to domain.com:<ssh-port> I can see an output of

SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1

I want to block direct port access except SSH, how can I do this with the iptables?

Answer 1

This is not something you can prevent with iptables, which doesn't examine the content of the traffic passing over the network. You could do what you want with an Application Firewall, but that might be overkill for your problem.

I would suggest that consider whether you really care so much about this issue to bother with all the extra effort of installing and configuring an application firewall. The effort might be better spent going through the options in the sshd_config file to ensure you have configured it as securely as you wish.

Answer 2

You can't. That's how the SSH-protocol works, the very first thing it does is tell you it's version.

You can also telnet to that same port and you will get the same result. The only thing iptables can do for you is only allow certain IP's from getting to that port.

Answer 3

This output is returned by SSH daemon to the connecting client. If you simply use:

$ telnet ip port
Trying ip...
Connected to ip.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1

You can find also the same line returned when using ssh -v -p port ip.

It is not clear what you want to do. You either allow access to this port or deny access. What do you mean by?

I want to block direct port access except SSH

Answer 4

By design, any application can connect to any IP port. Once the connection is established things then go up to the application level to communicate with each other. Direct port access is at a lower level than SSH. Port access is at the IP level, SSH is at the application level. Port connections are established before SSH is even a part of the picture. Once the port connection is established then SSH is able to start doing its thing.

You need an application level protocol analyzer to intercept connections on the port in order to do what you're thinking. That analyzer needs to be able to read connections on the port, look at the application level protocol involved, then block the connection based on what application level protocol is in use. I'm not an iptables expert, but I don't think that it can do this level of filtering. You probably need a more advanced firewall product to do this. (Someone can correct me if I'm wrong on that).

Answer 5

If I understand your question correctly... you've configured your ssh server to listen on port 80. HTTP traffic is typically done over port 80. When using a web-browser to connect to that box... you see the initial data sent by the ssh server.

If this is the case, there is nothing you can do with iptables to "block" web-browsers and only accept ssh clients. You either leave the port open... or you don't.

Answer 6

So, you're trying to do something like curl http://example.com:22?

Yes, in that case, you will get the SSH banner SSH-2.0-OpenSSH_5.3 or whatever it is you're using, and the HTTP browser will error out because it's not an HTTP response.

There's nothing you can do about that: it's the service advertising itself. See the FAQ: http://www.openssh.org/faq.html#2.14

You are first making a TCP connection (level 4). Once that happens, the applications (server and client) start talking to establish their communications. The server says SSH-2.0-OpenSSH_5.3, 220 mail.example.com ESMTP Postfix or whatever is appropriate to the protocol, and waits for the client. The client either recognizes what the server is (in which case they start communicating), or it bails out with a protocol mismatch (e.g., Firefox says that it can't connect). You can't really keep the banner from displaying after TCP establishes.

If you want to "block direct port access", you'll have to block it below the application level, perhaps with a firewall rule that prevents all connections to that port except for a whitelisted IP address.