9

How can I setup open ssh server so that if i'm ssh'ng from a local lan I want it to be via port 22 but if I'm coming externally its via port 12345 for example.

Then for external access I'd like some different (stricter) rules in sshd_config

Improve this question
3
  • Please add more details on your network topology. How does the system connect to the outside? does it have more than one network interface? will external connections come from a router and, if so, how does the router handle or translate external connections? (maybe via NAT). Or is routing handled by the server itself, maybe using iptables?
    – roadmr
    Jul 25, 2013 at 16:53
  • It works on 18.04
    – VikingGlen
    Dec 11, 2018 at 16:10
  • Zeke's answer below worked for me on 18.04. Regarding your external sshd, you can limit users with the AllowUsers option. How strict do you want? Create a user with a password for a username: eR4d092a. Jail him. Limit him to a couple of commands. Require he "su" out to get into your system. Alias the "su" command. For example, "su" becomes "alberny." Make eR4d092a's password 14 to 16 characters. Limit external access only to eR4d092a: AllowUsers eR4d092a No one will ever guess a username-password combination set up this way on a non-standard port.
    – VikingGlen
    Dec 11, 2018 at 16:20

2 Answers 2

Reset to default
11

Eric Carvalho's answer works for pre 15.04 but they deprecated and then removed upstart from Ubuntu, SystemdForUpstartUsers.

These steps have been adapted to work with systemd.

  1. Copy the SSH configuration file:

    sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config_external

  2. Copy the systemd configuration file:

    sudo cp /lib/systemd/system/ssh.service /lib/systemd/system/sshd-external.service

    in the new file (/lib/systemd/system/sshd-external.service) change the line:

    ExecStart=/usr/sbin/sshd -D $SSHD_OPTS

    to:

    ExecStart=/usr/sbin/sshd -D $SSHD_OPTS -f /etc/ssh/sshd_config_external

    and the line:

    Alias=sshd.service

    to:

    Alias=sshd-external.service

  3. Now customize /etc/ssh/sshd_config_external to your needs (e.g. change Port 22 to Port 12345)

  4. enable the service

    sudo ln -s /lib/systemd/system/ssh-external.service /etc/systemd/system/sshd-external.service

    If you have run the above command then run sudo systemctl disable sshd-external.service before running the next command

    sudo systemctl enable sshd-external.service

    sudo service sshd-external start

This has been tested on Ubuntu 16.04 on real hardware and a virtual machine in virtualbox.

Let me know if this doesn't work. I've been known to make typos.

Improve this answer
3
  • 2
    It works on 18.04
    – VikingGlen
    Dec 11, 2018 at 16:12
  • It seems that sshd-external will use pam_unix() auhentication, and I had to create /etc/pam.d/sshd-external to configure non default pam.
    – zzz777
    Mar 14, 2021 at 4:07
  • Works on Ubuntu 20.04 - You just need to use: sudo systemctl start sshd-external to start the second instance. service sshd-external start - may be a typo
    – gpwr
    Jun 7, 2022 at 7:18
3

Create another SSH service instance.

  1. Copy the SSH configuration file:

    sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config_external

  2. Copy the upstart configuration file:

    sudo cp /etc/init/ssh.conf /etc/init/ssh-external.conf

    In the new file (ssh-external.conf), change the line:

    mkdir -p -m0755 /var/run/sshd

    to:

    mkdir -p -m0755 /var/run/sshd-external

    And change the line:

    exec /usr/sbin/sshd -D

    to:

    exec /usr/sbin/sshd -D -f /etc/ssh/sshd_config_external

  3. Create the link to upstart:

    sudo ln -s /lib/init/upstart-job /etc/init.d/ssh-external

Now customize /etc/ssh/sshd_config_external to your needs (e.g. change Port 22 to Port 12345) and start the service:

sudo service ssh-external start
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .