FC16 - moving sshd to another port

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/08/2011 12:14 PM, Michael Schwendt wrote:
> On Thu, 08 Dec 2011 09:26:31 -0500, RM (Robert) wrote:
> 
>> I have always run SSHD on a different port as part of my
>> obfusication. Yeah, I know it will not stop good portscanners,
>> but it stops all that stupid doorknocking on port 22...
>> 
>> So I changed sshd_config to use port 557 (not really, but I'm not
>>  telling here) and enabled root login (yeah I know I can get in
>> and then do a su -, but perhaps I am a bit lazy).  And restarted
>> sshd (service sshd restart).
>> 
>> Will this got:
>> 
>> Redirected to /bin/systemctl
>> 
>> And then doing a service sshd status I see that it failed with 
>> status=255.  Oops perhaps the firewall, I did not open port 557.
> 
> No. The firewall settings would not stop sshd from listening.
> 
>> So I go over to the firewall gui and open port 557 as a custom
>> TCP port.  Restarted sshd.  Still a failure.  hmmm.  Oh, is this
>> the SELinux stuff that I would always disable?  Maybe this time I
>> want to fight with SELinux instead of just disabling it, but what
>> to do here?  Help?
> 
> You've messed up your system somehow, as normally you would be
> helped by setroubleshootd. And yes, there's at least one SELinux
> boolean related to this: setsebool -P sshd_forward_ports 1

Were you running setroubleshoot?  It should have told you something like:

# semanage port -a -t ssh_port_t -p tcp 557

http://danwalsh.livejournal.com/9275.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk7hDCoACgkQrlYvE4MpobOwmwCgxKVWj5HwcLjhB1jaaQKc0MfA
whcAoKcWj1Ut/XJw7UkFTG8ASocEPwwQ
=OsCz
-----END PGP SIGNATURE-----