Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am following this (basic) security guide to change my Server's SSH port to something else.

It says:

$ semanage port -a -t ssh_port_t -p tcp 2345 #Change me 

...which would add a new label on top of port 2345 to say that this is relevant for SSH, and that the SSH process can access this port.

What bugs me, is that this does NOT remove the label on the old port 22.

Is it safer to leave the old label in place, or is it safer to remove it? I don't know if the default setting for ports are within confined or unconfined space, and I think this may matter.

Please correct me if I am wrong, but the command for removing the old port is:

# semanage port -d -p tcp 22
share|improve this question
up vote 3 down vote accepted

There's no significant reason to remove the port type label from port 22 (nor is relocating your ssh server to another port necessarily going to make you more secure). If you do remove the label, then sshd will not be able to bind to port 22 and listen for connections.

share|improve this answer
Out of curiosity, you mentioned (nor is relocating your ssh server to another port necessarily going to make you more secure). Why not? I would have thought that For a hacker to determine ssh is running on your machine, he'll most likely scan port 22 to determine this. An effective method is to run ssh on a non-standard port. would apply? – Florian Mertens Sep 8 '13 at 20:34
This only "protects" you from drive-by scanners who just try a large number of default usernames and passwords. Not allowing root logins with a password, and making sure you have strong passwords for all users, is sufficient there. Moving the port is not sufficient for a targeted attack, as the attacker can find the new port number in a few seconds with a port scan. – Michael Hampton Sep 8 '13 at 20:39
Ok. Thank you ! – Florian Mertens Sep 9 '13 at 16:25
@MichaelHampton What if you use port scan detection and block such attempts. (blacklisting ips that trying to get to undefined ports)? Why it's not possible to run the following command semanage port -d -t ssh_port_t -p tcp 22 and delete default port? I get error like this: Port tcp/22 is defined in policy, cannot be deleted – Ilia Rostovtsev Jul 24 '15 at 16:44
@MichaelHampton Did you find a way around this policy thing? – Achilles Feb 8 at 15:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.