Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am following this (basic) security guide to change my Server's SSH port to something else.

It says:

$ semanage port -a -t ssh_port_t -p tcp 2345 #Change me 

...which would add a new label on top of port 2345 to say that this is relevant for SSH, and that the SSH process can access this port.

What bugs me, is that this does NOT remove the label on the old port 22.

Is it safer to leave the old label in place, or is it safer to remove it? I don't know if the default setting for ports are within confined or unconfined space, and I think this may matter.

Please correct me if I am wrong, but the command for removing the old port is:

# semanage port -d -p tcp 22
share|improve this question

1 Answer 1

up vote 2 down vote accepted

There's no significant reason to remove the port type label from port 22 (nor is relocating your ssh server to another port necessarily going to make you more secure). If you do remove the label, then sshd will not be able to bind to port 22 and listen for connections.

share|improve this answer
    
Out of curiosity, you mentioned (nor is relocating your ssh server to another port necessarily going to make you more secure). Why not? I would have thought that For a hacker to determine ssh is running on your machine, he'll most likely scan port 22 to determine this. An effective method is to run ssh on a non-standard port. would apply? –  Florian Mertens Sep 8 '13 at 20:34
2  
This only "protects" you from drive-by scanners who just try a large number of default usernames and passwords. Not allowing root logins with a password, and making sure you have strong passwords for all users, is sufficient there. Moving the port is not sufficient for a targeted attack, as the attacker can find the new port number in a few seconds with a port scan. –  Michael Hampton Sep 8 '13 at 20:39
    
Ok. Thank you ! –  Florian Mertens Sep 9 '13 at 16:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.