4

I have changed the SSH server config file /etc/ssh/sshd_config:

Port 2222

Then I restarted the SSH server service: systemctl restart ssh.service.

However, the SSH server is still running on port 22, because I can still reach it on the default port, and ss -tulpn shows:

> ss -tulpn
Netid    State     Recv-Q    Send-Q    Local Address:Port    Peer Address:Port    Process
tcp      LISTEN    0         4096                  *:22                 *:*        users:(("sshd",pid=16720,fd=3),("systemd",pid=1,fd=163))

Note: I'm using a freshly installed Ubuntu 24.04 server.

1
  • 1
    Is there an ssh.socket service unit (systemctl status ssh.socket)? If so, you will need to modify the socket unit (or reconfigure things to not use socket activation).
    – larsks
    Commented May 18 at 18:10

1 Answer 1

5

Apparently, Ubuntu has been using systemd-sockets for some time now, which makes the port configuration in the SSH server configuration obsolete.

To change the port of the SSH server, the systemd configuration for ssh.socket must be changed or supplemented. The configuration adjustment is made by creating a *.conf file in the directory /etc/systemd/system/ssh.socket.d/.

  1. Create conf file to extend the default config:
    systemctl edit ssh.socket
          or
    vim /etc/systemd/system/ssh.socket.d/override.conf

    [Socket]
    ListenStream=
    ListenStream=2222
    

    The line ListenStream= is required that port 22 is no longer used. Without this line, the SSH server would then be accessible via port 22 (default) and 2222.

  2. Restart the socket:
    systemctl restart ssh.socket

2
  • That's good to know, but this is really preposterous. And the fact that you must have an empty ListenStream line to disable port 22 is a huge security risk. Who thought this was a good idea ? What other security-sensitive configuration parameters in various services are silently overloaded by systemd ? Systemd haters really have a point here.
    – wazoox
    Commented May 24 at 9:28
  • > Who thought this was a good idea ? This is a question that comes with every systemd update since inception. It's a moot questions, unfortunately.
    – egorFiNE
    Commented 1 hour ago

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .