Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running CentOS release 6.2 (Final).

I want the sshd port of listen on ports 22 and 1022.

I have add the following lines to /etc/ssh/sshd_config:

Port 22
Port 1022

and restarted sshd and turned iptables off however I cannot connect to sshd on port 1022.

Even if I do the following

#Port 22
Port 1022

sshd continues listening on port 22 and does not listen on port 1022. I have tried other port values besides 1022 but no luck.

Help!

share|improve this question
    
Choose a different alternative port than 1022. People like to use port 2222, for instance. – ewwhite Dec 24 '12 at 13:35
up vote 10 down vote accepted

If you were using CentOS 5 the configuration you describe does work but a quick test suggests that sshd on CentOS 6 won't bind to any port below 1023 except 22 - I can't find a reference for this at the moment. If you want to access sshd on multiple ports then pick one >=1024.


Update - this is related to SELinux. Current policy doesn't allow sshd to bind to non standard ports below 1023 (as experiment confirms) e.g.

semanage port -l | grep 22
ssh_port_t                     tcp      22

If you want to add an additional port <=1023 you will have to explicitly allow it in SELinux

semanage port -a -t ssh_port_t  -p tcp 1022
semanage port -l | grep 22
ssh_port_t                     tcp      1022, 22

then restart sshd

netstat -tnlp
tcp      0    0 0.0.0.0:22          0.0.0.0:*             LISTEN      25376/sshd
tcp      0    0 0.0.0.0:1022        0.0.0.0:*             LISTEN      25376/sshd
share|improve this answer
    
oh wow ... amazing – user1172468 Dec 24 '12 at 16:40
    
This appears necessary even for ports >=1024. – JJC Feb 9 at 17:32
    
Yes, it's an SELinux issue. You can only bind to ports that are of type ssh_port_t. – Iain Feb 9 at 18:00

This is basically not recommended but anyway this is achieve-able.

cp /etc/ssh/sshd_config /etc/ssh/sshd_config-another

Edit the sshd-config-another file and assign different port no and pid file.

Port 1022
PidFile /var/run/sshd-another.pid

Now run,

ln -s /usr/sbin/sshd /usr/bin/sshd-another
cp /etc/rc.d/init.d/sshd /etc/rc.d/init.d/sshd-another

Open the new init script and make changes accordingly.

# config: /etc/ssh/sshd_config-another
# pidfile: /var/run/sshd-another.pid
[ -f /etc/sysconfig/sshd-another ] && . /etc/sysconfig/sshd-another
prog="sshd-another"
SSHD=/usr/sbin/sshd-another
PID_FILE=/var/run/sshd-another.pid

Create /etc/sysconfig/sshd-second file.

OPTIONS="-f /etc/ssh/sshd_config-another"

Separate PAM configuration.

ln -s /etc/pam.d/sshd /etc/pam.d/sshd-another

Restart the service.

service sshd restart
service sshd-another restart

Chkconfig it.

chkconfig --add sshd-another
chkconfig on sshd-another
share|improve this answer
    
Hi Iain, can you point me to the documentation please. I must have been overlooking things then. – Soham Chakraborty Dec 24 '12 at 13:04
1  
Look up the Port directive in man sshd_config. – Iain Dec 24 '12 at 13:13
1  
This answer is interesting but is an answer to a different question, which would be: can I run two different sshd instances with two different configs? And you're writing how to do it. This is useful in particular when some server has to ensure continuity of a ssh service which was served by another machine with another private server key. – Stéphane Gourichon Nov 21 '15 at 19:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.