[fChk]

Before we begin, please note that changing SSHD's port isn't much about security but about reducing the size of your log files and shaving off few CPU cycles due to the inevitable automated(/random) login attempts directed towards the default SSH port (ie port 22.)

Indeed, our assumption here is that you do know better and that you've already disabled SSH password login in favour of the public-key authentication [1]; thus our problem is to get SSH daemon off its default port to not bother with those failed login attempts that are piling up in the logs and get the 'poor' fail2ban service a break (in case you did install it), which save us few CPU cycles.

1-Make SSHD Listen on 2 Ports:
What we'll do is to configure 'sshd' to listen on two ports, the default and the random one (eg 4600.) This is a good practice to avoid being locked out of the VPS if something goes wrong.

Code: (Select All)

vi /etc/ssh/sshd_config
# Uncomment the line, # Port 22
Port 22
Port 4600

Next we need to check if SSHD does indeed listen on both ports, as follows:

Code: (Select All)

[root@centos ~]# netstat -tulpn|grep sshd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      836/sshd            
tcp6       0      0 :::22                   :::*                    LISTEN      836/sshd            

At our surprise, SSHD failed to listen on our selected port!!.. What might be the cause? If we check the logs, we see this:

Code: (Select All)

[root@centos ~]# journalctl -u sshd -f
-- Logs begin at Wed 2020-04-08 14:54:06 +01. --
Apr 10 16:39:52 centos.xyz.xy sshd[836]: Server listening on :: port 22.
Apr 10 16:39:52 centos.xyz.xy sshd[836]: error: Bind to port 4600 on 0.0.0.0 failed: Permission denied.
Apr 10 16:39:52 centos.xyz.xy sshd[836]: error: Bind to port 4600 on :: failed: Permission denied.
Apr 10 16:39:52 centos.xyz.xy systemd[1]: Started OpenSSH server daemon.

2- Enable the Selected Port Usage by SSHD with SELinux:
So, SSHD failed with a permission denied. Of course, SSHD doesn't have the permission to listen on any port other than its own/22; says WHO?.. Well, SELinux says so, and it's in its enforcing mode.

Code: (Select All)

[root@centos ~]# semanage port -l | grep ssh
ssh_port_t                     tcp      22

What we need to do is ask SELinux for permission to use port 4600 for SSHD, like so:

Code: (Select All)

[root@centos ~]# semanage port -a -t ssh_port_t -p tcp 4600
# Now let's see:
[root@centos ~]# semanage port -l | grep ssh
ssh_port_t                     tcp      4600, 22

Now let's test again to see if it's working:

Code: (Select All)

# First restart SSHD
[root@centos ~]# systemctl restart sshd
#check on which ports SSHD is listening on:
[root@static ~]# netstat -tulpn|grep sshd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      2776/sshd          
tcp        0      0 0.0.0.0:4600            0.0.0.0:*               LISTEN      2776/sshd          
tcp6       0      0 :::22                   :::*                    LISTEN      2776/sshd          
tcp6       0      0 :::4600                 :::*                    LISTEN      2776/sshd          

It's all good!

3- Open the Firewall to the Selected SSHD Port:
We need to let the port 4600 through the firewall:

Before: only ssh and dhcp services are allowed to pass through

Code: (Select All)

[root@centos ~]# firewall-cmd --zone=public --list-all
public (active)
 target: default
 icmp-block-inversion: no
 interfaces: ens3
 sources:
 services: dhcpv6-client ssh
 ports:
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

We now want to allow port 4600/tcp through

Code: (Select All)

[root@centos ~]# firewall-cmd --zone=public --add-port=4600/tcp --permanent
success
[root@centos ~]# firewall-cmd --reload
success

Now TCP traffic through port 4600 is also allowed:

Code: (Select All)

[root@centos ~]# firewall-cmd --zone=public --list-all
public (active)
 target: default
 icmp-block-inversion: no
 interfaces: ens3
 sources:
 services: dhcpv6-client ssh
 ports: 4600/tcp
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

4-Test SSHD Login with the Custom Port:
At this stage we have to completely logout and test if we can login with the new port:
If we exit our shell both as root and sudoer:

Code: (Select All)

[root@centos ~]# exit
logout
[user@centos ~]$ exit
logout
Connection to 50.*.*.* closed.
[user@local ~]$ ssh -i ~/.ssh/centos-key-ecdsa 50.*.*.* -p 4600
Activate the web console with: systemctl enable --now cockpit.socket

Last login: ....
[user@centos ~]............................YOUR.IN

Our setup is working!

5-Disable SSHD Default Port:
> To Shut-off SSHD default port through the firewall

Code: (Select All)

[root@centos ~]# firewall-cmd --zone=public --remove-service=ssh --permanent
success
[root@centos ~]# firewall-cmd --reload
success
[root@centos ~]# firewall-cmd --zone=public --list-all
public (active)
 target: default
 icmp-block-inversion: no
 interfaces: ens3
 sources:
 services: dhcpv6-client
 ports: 4600/tcp
 protocols:
 masquerade: no
 forward-ports:
 source-ports:
 icmp-blocks:
 rich rules:

From this moment onward, we're done with those random poking around port 22; the logs will be much cleaner and fail2ban will thank you for it.

6- Make SSHD Listen on the Selected Port Only:
> Last thing to do is to completely remove port 22 from the SSHD config and restart the SSHD daemon, and I'll leave that to you.

That's all there is to it.


Notes:
[1]- If you're unsure, please check Running Fedora inside an LXD/LXC System Container for a reminder.