23

I need to listen to SSH on two ports: 22 for hosting admin access and 26 for regular access. I would like to disallow root login on 26 and disallow all but internal IPs for port 22. The latter can be done with iptables rules, but I don't know about the former. Any ideas?

  • 3
    root should never be able to login via ssh; period; end of story; buck stops here; never. If you need root access then you login via your normal user, then elevate with su or better yet sudo. – Chris S Jun 27 '11 at 17:14
  • 6
    It's entirely okay to allow root logins over ssh if you restrict them to key authentication, or even password authentication if the session is restricted to IP addresses you control. 'Never' is too strong. – EightBitTony Jun 27 '11 at 17:24
  • 3
    I'd argue that there are situations where it makes sense to have a root login (e.g. Filesystem corruption on the /home partition, precluding login as a standard user). One thing that can help is to set the sshd_config PermitRootLogin parameter to without-password. This only allows root login via ssh to occur with an ssh key. Password authentication will not work. – ewwhite Jun 27 '11 at 17:29
  • This article might be helpful: everythingsysadmin.com/2010/09/… – TomOnTime Jun 27 '11 at 17:36
26

In /etc/ssh/sshd_config, make the following change. Look for the line that says Port 22 and add a similar line under it.

Port 22
Port 26

Save the file and restart the sshd daemon.

I do this in situations where I have ssh enabled for internal users on port 22, but require external connectivity on say, port 2222. This binds the ssh daemon to both port numbers.

  • 5
    And how do you restrict root logins to port 22 now? – faker Jun 27 '11 at 18:12
  • @faker I've seen the use of firewall/network restrictions to only provide a whitelist of ip's access to regular port 22. – ThorSummoner Jun 24 '15 at 16:31
10

You can use the -f option to sshd to specify an alternate configuration file. In the configuration file you would need to use the

Port 26 

directive to change the port that the sshd is listening on.

set

PermitRootLogin no

to disable root logins

You can then do something like

/usr/sbin/sshd -f /etc/ssh/sshd_config_port_26

You may want to copy the standard sshd startup script and modify them so that you can start the port 26 service at startup.

Why are you doing this ?

  • Instead of having two whole configuration files, if you wanted the servers to be otherwise essentially similar, wouldn't it be more straightforward and appropriate to just add -o PermitRootLogin yes -p 26 – JamesTheAwesomeDude Mar 19 at 15:37
3

Assuming sshd will run with a command-line specific config file, then you could create a second config that runs on port 26 and execute a second start-up script that refers to that port.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.