Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I've done this a few dozen times on a 'normal' box (not in EC2) and it seems simple enough. I was trying to run ssh on port 22 and 80 but I couldn't, for the life of me, figure out why I can't connect through port 80 but I can connect fine using port 22. So here's what I've done:

  1. Create a fresh instace (I used a smaller RHEL instance since I was trying to implement it for a RHEL HVM instance)
  2. SSH into the machine and update /etc/ssh/sshd_config and added the lines Port 22 and Port 80
  3. Added a new rule to the iptables: iptables -I INPUT 3 -s 0.0.0.0/0 -d 0.0.0.0/0 -p tcp --dport 80 -m state --state New -j ACCEPT then sudo service iptables restart
  4. run services sshd restart

The restart says 'OK' and I'm able to connect using port 22. But I cannot connect through port 80. Then I install nmap but don't see anything running on port 80 (port 22 is there!). I am 200% sure that my security group is correct. I've even tried it in a new instance just in case the security groups didn't update in realtime.

A few things I've observed:

  1. stopping iptables and ip6tables service has no effect
  2. if I remove Port 22 from the sshd_config, I can no longer make new connections
  3. If I do the same steps (minus the iptables rule) on an Ubuntu AMI, I can successfully connect!

UPDATE: I still haven't found the problem but it's most likely caused by my ISP (maybe they're blocking traffic from port 80 that isn't HTTP traffic). Its not secret that Singapore is doing a lot of traffic filtering so its not impossible. I tried running SSH from a different port and that works. Also, connecting to SSH in port 80 from another EC2 instance from a different region works. So anyway, I've marked the most upvoted answer.

share|improve this question
    
Out if interest...what's the purpose of running ssh on port 80? –  Drew Khoury May 10 at 15:33

4 Answers 4

up vote 2 down vote accepted

Do you have port 80 defined in the security group which the instance belongs to? Below is an example how it may look:

enter image description here

By the way, I do it a bit different way. Perhaps, you will find it useful. I use iptables and DNAT target to forward SSH without touching SSH server configuration:

iptables -t nat -A PREROUTING -m tcp -p tcp --dport 80 -j DNAT --to-destination INSTANCE_IP:22

Additionally, you have to add another rule to allow traffic to port 80.

iptables -A INPUT -m tcp -p tcp --dport 80 -j ACCEPT
share|improve this answer

This is a SELinux configuration in RHEL that will not allow you to add ports as you please. Using netstat -ntlp you will see that sshd is not running on port 80 as you would think based on sshd_config. Also a quick check of your /var/log/secure will show you the failed attempts to bind on port 80. What you'll have to do first is to modify your selinux configuration:

semanage port -m -t ssh_port_t -p tcp 80

A quick check:

semanage port -l | grep ssh

will confirm that port 80 has been added.

Now you can edit your sshd_config and reload sshd.

share|improve this answer

Why running sshd on two ports? And especially port 22 and 80. Please consider using port over "30000" to "63000" for at least being skipped by simple port scanners. But running SSHd on two ports at the same time doesn't make any sense (exception is if you are going to connect from inside a very restrictive corporate firewall - in this case your firewall should be more restrictive too) If you insist on using port 22 and 80 put in /etc/ssh/sshd_config:

Port 22
Port 80

Then:

# service sshd restart
# service iptables restart               (to clean any experiments you did lately)
# iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
# iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
# service iptables save                  (to save your config)

I'm not avising opening those ports just like that to the whole world, you should be more restrictive like:

# iptables -A INPUT -p tcp -m state --state NEW -m tcp -s 1.2.3.4 --dport 80 -j ACCEPT

Where 1.2.3.4 is the ip you are going to connect from.

share|improve this answer

Sounds like port 80 isnt open in your security group

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.