0

I thought it would be easy, but that does not seems to be the case.
I'd like to change the port that SSHD (SSH daemon) is listening on.

So I simply changed the entry in /etc/ssh/sshd_config that says Port 22 (commented) to Port xx (uncommented). In addition, I didn't want SSHD to communicate over IPv6, so I both set AddressFamily inet and ListenAddress 0.0.0.0.

I thought this would do it, so I restarted the service with sudo service sshd restart. And sudo service sshd status showed me that it started successfully, listening on port xx (new port).

However, after a reboot, I can't login on the new port, only the default port 22 works:

sudo service sshd status:

● ssh.service - OpenBSD Secure Shell server
   Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
   Active: inactive (dead)

It says it's inactive.

Although sudo lsof -I :22 tells me something different:

systemd    1          root   98u  IPv6  20051      0t0  TCP *:ssh (LISTEN)
systemd    1          root  122u  IPv6  24542      0t0  TCP ubuntu-server01.router:ssh->End-Device.router:50350 (ESTABLISHED)
sshd    1842          root    3u  IPv6  24542      0t0  TCP ubuntu-server01.router:ssh->End-Device.router:50350 (ESTABLISHED)
sshd    1842          root    4u  IPv6  24542      0t0  TCP ubuntu-server01.router:ssh->End-Device.router:50350 (ESTABLISHED)
sshd    1998 mainuser    3u  IPv6  24542      0t0  TCP ubuntu-server01.router:ssh->End-Device.router:50350 (ESTABLISHED)
sshd    1998 mainuser    4u  IPv6  24542      0t0  TCP ubuntu-server01.router:ssh->End-Device.router:50350 (ESTABLISHED)

Hey, if sshd is inactive, how can there still run ssh processes on port 22 with IPv6 if I changed the port and protocol?

That's strange. I also can't remember to have installed any other ssh daemon than OpenSSH (but I'm not sure, I don't know how to find this out).

The config file:

#   $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Port xx [_made unreadable_]
#AddressFamily any
AddressFamily inet
ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
AuthorizedKeysFile  .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem   sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#   X11Forwarding no
#   AllowTcpForwarding no
#   PermitTTY no
#   ForceCommand cvs server
AllowGroups 

EDIT:

I just executed the following command:
sudo systemctl disable ssh.socket
(and a reboot) Which, at least so far, seems to have solved the problem. The SSH daemon no longer listens on port 22, but on my specified port. I still don't know why this happened.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.