I've got a debian-machine running several services, like apache with http and https, jabber and an openssh server for administration. The ssh-server is not running on port 22. It's on something like port 62111. I secure the openssh with fail2ban. So whenever an attacker tries to connect to ssh on port 62111 he has got two tries before being banned for two day by fail2ban on port 62111.

I would like to start a (fake) SSH-Server on Port 22 and whenever someone tries to connect to that port he gets banned on all port by iptables forever or at least until i drop the iptables rule. Any legal SSH connection will not try to ssh to port 22, because every administrator knows the correct SSH-port.

The idea is that an attacker will try to attack port 22 first. Therefore he hasn't even got a chance to try to SSH to port 62111. I don't care about those cracker to see my website. So it's fine to block them on any port (including 80 and 443).

Any suggestion on how to do this?

  • 1
    You can do this with TCP wrappers and fail2ban - just set up a hosts.allow recipe which triggers a an event caught by fail2ban. – symcbean Sep 7 '13 at 22:21
  • That sounds like portsentry – tylerl Sep 8 '13 at 0:34
  • Frankly your biggest threat vector is your web service. Most successful attacks on web servers occur due to weaknesses in the engineering of the web service. Your points on SSH are still a valid concern but dont forget to expend the same amount of effort on all services you provide for public consumption. – Matthew Ife Sep 28 '13 at 17:06

I will try to suggest you another solution for the paranoid:)


It works by requiring connection attempts to a series of predefined closed ports. When the correct sequence of port "knocks" (connection attempts) is received, the firewall opens certain port(s) to allow a connection.

And of course only ssh key authentication.


No good idea (IMHO).

A connection to port 22 does not automaticly mean someone is trying to break in to your server.

To protect your server from hacker/cracker follow some simple rules (ex).

  • Use tools like fail2ban wise
  • keep your services (ssh, http,...) always up to date
  • use strong passwords (and change them circular)
  • use ssh-keys for sshd and disable password authentication
  • Can you provide an example of a legitimate attempt to connect to port 22? – symcbean Sep 7 '13 at 22:22
  • 2
    A NAGIOS-like system looking for an ssh banner to determine that the service is up? – MadHatter supports Monica Sep 8 '13 at 5:53
  • I upvoted because I think all of this is in general better advise to take on board, but the submitter has never made it clear he isn't doing all of this already. You should always have a try at multiple layers of security. – Matthew Ife Sep 28 '13 at 17:03

I you want to run sshd on other port and still use same fail2ban etc - i've found a very nice, similar manual here: http://www.kudos.be/multiple_sshd

Will re-post and change things for you here:

The goal is to run same daemon with on two different ports and disable any kind of authentication on one instance.

  1. Copy configuration:

    cd /etc/ssh/sshd_config /etc/ssh/sshd_config-fake

  2. change configuration according to this:

    change Port, SyslogFacility, *Authentication strings (disable for fake), PidFile

  3. create symlink: ln -s /usr/sbin/sshd /usr/sbin/sshd-fake

  4. create init script: cp /etc/init.d/sshd /etc/init.d/sshd-fake and modify contents of sshd-fake file accordingly.

  5. change /etc/sysconfig/sshd-fake: OPTIONS="-f /etc/ssh/sshd_config-fake"

  6. add service chkconfig --add sshd-fake

  7. create pam configuration: cp /etc/pam.d/sshd /etc/pam.d/sshd-fake

  8. edit /etc/pam.d/sshd-fake and disallow everything, or use different method, like allow users listed from file: http://linux.die.net/man/8/pam_listfile

  9. restart services: service sshd restart;service sshd-fake restart;chkconfig sshd-fake on

  10. configure fail2ban accordingly


This might not be the most elegant, but it should be quick and functional:

iptables -I INPUT --m recent --name blocked --rcheck -j DROP
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --name blocked --set


Insert a firwall rule (at the top) in the input chain, that checks to see if the source address of the packet is currently in the "blocked" list, and if it is, DROP it.

Insert another firewall rule (above the one we just inserted) in the input chain that adds the source address of any connection attempt to port 22 to the "blocked" list.

I don't see the need to actually run a (fake) server, or any listener at all on port 22.

Edit: Looking at my answer, I want to add that you probably should timeout your blocked list in some other way than

"forever or at least until i drop the iptables rule"

because you will get a lot of hits from dynamic ip addresses that will be later (within a matter of hours, or even minutes) reassigned to legitimate users.

See: http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-3.html#ss3.16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.