4

I have an internet facing web server that I also need to be able to SSH into. I'd like to update my server to change the SSH port from something other than 22 so there are fewer hits for unauthorized access. (This is not my primary security measure. Just an additional minor tweak. I'm also using fail2ban and turning off password login.)

How can I pick a port to use that I know won't cause issues/conflicts?

1
  • 1. See which ports are open 2. Research any other software you want to install 3. Pick a port not currently in use, or needed by future installs.
    – NickW
    May 20, 2013 at 16:27

5 Answers 5

5
netstat --inet -lnp

tells you which services are running on your machine. (Possible but improbable that others are just inactive at the moment.)

As long as you don't use one of them you are OK. You may choose a well known port of a service you are sure never to use. Telnet maybe :-) (But maybe there are attacks on that port, too.)

3

The IANA assigns ports for specific services. I would reference this list when selecting a port.

http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

2

I'm sure you can use anyone of the 65,535 ports available. You just need to make sure the port you chose doesn't interfere with any other application ports.

0

/etc/services contains your machine's list of all named ports to services. The list is not comprehensive but does detail all the major protocols and their associated ports you'll typically find. That information in conjunction with the information received by running the command (you only care about tcp not udp) will give you guidance to an alternative port:

netstat --inet -lnp | grep '^tcp'

You mentioned other security measures - I know not what they are but as you are probably aware this change alone will not really disguise anything to someone running a portscanner such as nmap.

If this machine is connected directly to a public network hopefully you are using iptables and sshd's configuration to limit the connections and who can connect.

0

Any unused port should do but some ports are more equal than others. If you ever have to connect within a proxy or captive portal you might have better luck (ab)using ports used by well-known protocols such as 443, 995, 993, or 587.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .