Centos – Changed SSH port, do I need to open the port using iptables

centosssh

UPDATE

As Khaled suggested, i changed my netstat command

netstat -lnp | grep 3899
tcp        0      0 :::3899           :::*              LISTEN      10333/sshd

So shouldn't it be listening?

I changed my ssh port on my centos 5.5 box to 3899. But I can't seem to login remotely to it. I have done this before but the last time, I didn't need to make any other changes to make it work.

iptables -L | grep 3899
[empty response]

iptables -L | grep 22
[empty response]

iptables -L | grep ssh
ACCEPT     tcp  --  anywhere       anywhere       state NEW tcp dpt:ssh

Best Answer

Yes, you probably need to adjust your firewall rules. To see your current rules:

iptables -nvL

If you see a bunch of ACCEPT rules and a REJECT rule at the end, that means your host is blocking all incoming connections except the specified ones.

I think you can use the system-config-securitylevel menu-based tool to open custom ports. Run that program in a terminal and choose the 'customize' button. Add 3899:tcp to the other ports list and save your changes. I'm not sure if system-config-securitylevel takes port numbers instead of service names. If specifying the port number in that tool doesn't work, you can try adding your custom 'myssh' service name to /etc/services and then using that name in system-config-securitylevel.

You can run

nmap -sS -v server.example.com

from an outside machine to scan your system to determine which ports are open.

Another way to make this change is to hand edit /etc/sysconfig/iptables, and copy the existing ssh entry to another entry right below it, but change the port from ssh to 3899. Note that it's easy to screw up your firewall config by hand-editing the iptables file, so be very cautious if you go this route. After you make changes, reboot the machine, or run /etc/init.d/iptables restart to load your changes.

Related Topic