{"id":4603,"date":"2015-04-26T18:56:47","date_gmt":"2015-04-26T10:56:47","guid":{"rendered":"http:\/\/rmohan.com\/?p=4603"},"modified":"2015-04-26T18:57:53","modified_gmt":"2015-04-26T10:57:53","slug":"change-the-default-ssh-port-and-alter-selinux","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=4603","title":{"rendered":"Change the default SSH port and alter SELinux"},"content":{"rendered":"<p>Security through obscurity is not something one would generally recommend. But to thwart the effort of automated scanners changing the default OpenSSH port will yield you less pain in every day life. This will not fend off directed attacks or nullify vulnerabilities or bad security design.<\/p>\n<p>Should you see an error message such as<\/p>\n<pre>shd[14221]: error: Bind to port 9898 on 192.168.0.50 failed: Permission denied<\/pre>\n<p>it indicates that the system prevented the daemon to bind that port. Most likely SELinux.<\/p>\n<p>The instructions provided will be valid on Fedora 14\/15, CentOS 6, RHEL 6, Scientific Linux 6 and newer versions.<\/p>\n<p>To change the default SSH port you need to do the following.<\/p>\n<ul>\n<li>Stop the SSH daemon<\/li>\n<li>Alter the \/etc\/ssh\/sshd_config with your new port<\/li>\n<li>Alter the SELinux context with semanage<\/li>\n<li>Start the SSH daemon<\/li>\n<\/ul>\n<h2>Stop the SSH daemon<\/h2>\n<pre># service sshd stop<\/pre>\n<h2>Alter the \/etc\/ssh\/sshd_config with your new port<\/h2>\n<p>Alter the configuration file with your favorite editor, in my case \u201cnano\u201d.<\/p>\n<pre># nano \/etc\/ssh\/sshd_config<\/pre>\n<p>Alter the port configuration parameter change the following line<\/p>\n<pre>Port 22<\/pre>\n<p>to<\/p>\n<pre>Port 9898<\/pre>\n<h2>Alter the SELinux context with semanage<\/h2>\n<pre># semanage port -a -t ssh_port_t -p tcp 9898<\/pre>\n<p>Initially you would think the following would work. But it will not. For it to work you would have to alter the policy in the selinux-policy package, rebuild and install it. So skip it, but now you know why.<\/p>\n<pre># semanage port -d -t ssh_port_t -p tcp 22<\/pre>\n<h2>Start the SSH daemon<\/h2>\n<pre># service sshd start<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Security through obscurity is not something one would generally recommend. But to thwart the effort of automated scanners changing the default OpenSSH port will yield you less pain in every day life. This will not fend off directed attacks or nullify vulnerabilities or bad security design.<\/p>\n<p>Should you see an error message such as<\/p>\n<p> shd[14221]: [&#8230;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,4,9],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/4603"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4603"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/4603\/revisions"}],"predecessor-version":[{"id":4604,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/4603\/revisions\/4604"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}