4

On a *nix system, when configuring ssh to listen on non standard port, should I also edit /etc/services to reflect that.

I would think it should be done, so tools that use it (such as ufw) will recognize the correct port for ssh, but I see very little mention of it in documentation and tutorials.

So is it considered good or bad practise to edit /etc/services, and if not, why?

5
  • cyrusimap.org/~vanmeeuwen/imap/admin/… Guys from Cyrus seems to do it. I don't know what credit you would give to them though Mar 5, 2016 at 15:25
  • @pat I imagine it's easier to get away with it for lmtp just based on how that protocol is used (locally, as the name implies). They also do document both approaches. Mar 5, 2016 at 15:47
  • @HåkanLindqvist, you're right, I agree with your answer ! Mar 5, 2016 at 18:20
  • I'm afraid this won't help that much- I get port scanners (scans open ports from 1 to 25565) a lot on my server, changing SSH port didn't lower the ssh brute force attempts that much.
    – ave
    Mar 5, 2016 at 18:34
  • @ardaozkal I doubt there is anybody port scanning all port numbers on all IPv4 addresses. Port scanning all port numbers on one IPv4 address or one port number on all IPv4 addresses is quite doable. Which means changing port number won't help much against a targeted attack. But if you are not a high profile target, then using a randomly chosen port number for ssh will usually eliminate all brute force attempts. I am not seeing any brute force attempts on hosts where I changed the ssh port.
    – kasperd
    Mar 6, 2016 at 10:28

3 Answers 3

12

I don't think it makes sense to edit /etc/services in such a case. The world will not change ssh ports with you, and all programs that look up service names to port numbers on your machine would get the incorrect port for ssh.

If anything, it might make more sense to add an entry of your own for your non-standard ssh port, eg myssh <yourport>/tcp if you want a service name that you can use.


Then there's obviously the age-long debate of whether changing ports like that to "hide" services actually serves any real purpose beyond reducing log spam.

2
  • 1
    Thanks @Håkan Lindqvist. Your answer is reasonable and useful. The only nit I would pick is that reducing log spam is a real security benefit. It allows one to better find the real information in the log.
    – Chen Levy
    Mar 5, 2016 at 17:40
  • Reducing spam is important if one must expose ssh to the internet. That makes parsing through alerts in a SIEM much easier so that the anomolies stick out more.
    – Aaron
    Mar 6, 2016 at 14:06
9

The file /etc/services contains the IANA assigned port numbers and there is not a single technical requirement to modify that file to be able to you run your services on a non-standard port. When you want a non-default port typically you can numerically set that port number in a service configuration file or with a start-up option.

I would also find it hard to diagnose why a service is not listening on its default port, when the non-standard port is not explicitly set in the start-up script or server configuration file, but taken from a modified /etc/services.

If you did change /etc/services to reflect your non-standard port number, please don't use an established service name such as ssh on your custom port as that might break connectivity when connecting to other system from yours.

You'll be hard-pressed to diagnose why ssh otherhost suddenly fails to connect when on that otherhost TCP/IP port 22 is open... .

2
  • I'm having difficulty understanding why I shouldn't be changing the port for ssh on my VPS server that has been pre-configured for SSH to be on a non-standard port. How could changing it in /etc/services make it "...break connectivity when connection to other systems from yours." WHY is this true? ssh is ACTUALLY running on a different port... so wouldn't this HELP prevent connectivity breakage by putting the port in a known location?! (Please realize this is a sincere question, I am a developer and definitely no Linux administration expert). Thanks for any reply
    – MER
    Sep 12, 2016 at 18:23
  • 1
    The expected behaviour for a ssh client when you run ssh user@host is for it to connect to the default ssh port , tcp 22. The fact that your ssh server runs on a different port doesn't make all the other servers run on that non standard port. Thats why you sjould not edit /etc/services. The correct way to deal with exceptions in that regard is in a host specific section of a ~/ssh/config if you're liable to forget that you are doing something different and non standard
    – HBruijn
    Sep 12, 2016 at 18:31
0

I think it's not a bad practice to change the port ssh listens at /etc/ssh/sshd_config to avoid possible attacks. Like it has been answered before, changing the description on /etc/services it's not necessary at all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .