3

I'm failing to set-up an ssd on port 9922. With standard configuration on port 22 everything works fine. Then I change the port to 9922 by adding this line to ths sshd_config file:

Port 9922

I can connect to the server in the LAN on port 22 without prolems. After switching to port 9922 I get the following ouptput:

# ssh -vvv -p 9922 [email protected]
OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.26.153 [192.168.26.153] port 9922.
debug1: connect to address 192.168.26.153 port 9922: No route to host
ssh: connect to host 192.168.26.153 port 9922: No route to host
#

And nmap -p 9922 192.168.26.153 gives:

# nmap -p 9922 192.168.26.153

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2012-06-11 08:09 CEST
Interesting ports on 192.168.26.153:
PORT     STATE    SERVICE
9922/tcp filtered unknown
MAC Address: 4A:34:E7:11:9F:22 (Unknown)

Nmap finished: 1 IP address (1 host up) scanned in 0.184 seconds
#

Any ideas what's missing?

ifconfig on the target machines gives:

eth0      Link encap:Ethernet  Hardware Adresse 4A:34:E7:11:9F:22  
          inet Adresse:192.168.26.153  Bcast:192.168.26.255  Maske:255.255.255.0
          inet6 Adresse: fe80::4834:e7ff:fe11:9f22/64 G?ltigkeitsbereich:Verbindung
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2723010 errors:0 dropped:0 overruns:0 frame:0
          TX packets:552 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenl?nge:1000 
          RX bytes:561183811 (535.1 MiB)  TX bytes:52703 (51.4 KiB)
          Interrupt:24 

lo        Link encap:Lokale Schleife  
          inet Adresse:127.0.0.1  Maske:255.0.0.0
          inet6 Adresse: ::1/128 G?ltigkeitsbereich:Maschine
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenl?nge:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

And route -n:

# route -n
Kernel IP Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
192.168.10.0    192.168.26.1    255.255.255.0   UG    0      0        0 eth0
192.168.26.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
0.0.0.0         192.168.26.4    0.0.0.0         UG    0      0        0 eth0
# 

iptables -L returns:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
# 
9
  • Is the firewall at 192.168.26.153 configured to allow incoming connections to 9922?
    – Hex
    Jun 11, 2012 at 5:45
  • It's a vanilla CentOs 6.2 installation. I did not set-up a firewall. Is there something set-up by default?
    – BetaRide
    Jun 11, 2012 at 5:50
  • "No route to host" says it all. Your network interface and/or your routing table can not find a route for the target address. What's the result of ifconfig and route -n?
    – ripat
    Jun 11, 2012 at 6:05
  • 2
    check if there are default rules "iptables -L" . Make sure if you can see the server by "ping 192.168.26.153"
    – Hex
    Jun 11, 2012 at 6:25
  • 2
    Woa, I was sure it was that :) I missed this part in your previews message: REJECT all -- anywhere anywhere reject-with icmp-host-pro This was what have blocked your traffic
    – Hex
    Jun 11, 2012 at 6:34

4 Answers 4

3

While it is not a smart idea to stop the firewall i would propose to start the firewall and allow incomming port 9922 by

/sbin/iptables -A INPUT -p tcp --dport 9922 -j ACCEPT

1
  • Yes, of course. Stopping it was just a quick test.
    – BetaRide
    Jun 11, 2012 at 7:34
4

You must likely have SELinux enabled at your server. If you don't need it, disable it temporarily with setenforce 0 or permanently by modifying /etc/selinux/config file.

If you want to use SELinux, make it allow sshd to bind to port 9922:

semanage port -a -t ssh_port_t -p tcp 9922
1
1

For me was a combo of Selinux and Firewall, I found the solution doing in this way:

As already proposed, relaxing Selinux:

semanage port -a -t ssh_port_t -p tcp 9922

And after that, changing even the firewall permission:

sudo firewall-cmd --zone=public --add-port=9922/tcp --permanent
sudo firewall-cmd --reload

These two changes make me possible to access to the server with the new ssh-port

1
  • 1
    A small note: firewall-cmd works when you have firewalld running. From the output of iptables -L it appears the OP does not use firewalld.
    – Onnonymous
    Apr 5, 2017 at 11:02
0

You can have multiple Port lines in your sshd.conf, e.g.

Port 22
Port 2222
#Protocol 2,1
Protocol 2
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

I typically do this because I'll have an external firewall/NAT open on the alternative port, but will want internal systems to hit the server on the traditional port 22.

Please make sure you restart the ssh daemon (service sshd restart) following any configuration file changes.

What happens if you nmap -p 9922 192.168.26.153? Does it show the port open?

The error in your ssh client debug output should be "Connection timed out" instead of "No route to host". What's in between you and the target system?

3
  • There's nothing between the two machines. They are in the same LAN.
    – BetaRide
    Jun 11, 2012 at 6:08
  • Did you restart the ssh daemon? The nmap output indicates that it's not listening on the preferred port. netstat -anp | grep sshd on the target server would confirm this.
    – ewwhite
    Jun 11, 2012 at 6:23
  • Yes, I did. And I can confirm that sshd is running and listening on port 9922.
    – BetaRide
    Jun 11, 2012 at 6:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .