FC16 - moving sshd to another port

[Robert Moskowitz]

On 12/08/2011 02:46 PM, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 12/08/2011 02:39 PM, Robert Moskowitz wrote:
>> On 12/08/2011 02:12 PM, Daniel J Walsh wrote: On 12/08/2011 12:14
>> PM, Michael Schwendt wrote:
>>>>> On Thu, 08 Dec 2011 09:26:31 -0500, RM (Robert) wrote:
>>>>>
>>>>>> I have always run SSHD on a different port as part of my
>>>>>> obfusication. Yeah, I know it will not stop good
>>>>>> portscanners, but it stops all that stupid doorknocking on
>>>>>> port 22...
>>>>>>
>>>>>> So I changed sshd_config to use port 557 (not really, but
>>>>>> I'm not telling here) and enabled root login (yeah I know I
>>>>>> can get in and then do a su -, but perhaps I am a bit
>>>>>> lazy).  And restarted sshd (service sshd restart).
>>>>>>
>>>>>> Will this got:
>>>>>>
>>>>>> Redirected to /bin/systemctl
>>>>>>
>>>>>> And then doing a service sshd status I see that it failed
>>>>>> with status=255.  Oops perhaps the firewall, I did not open
>>>>>> port 557.
>>>>> No. The firewall settings would not stop sshd from
>>>>> listening.
>>>>>
>>>>>> So I go over to the firewall gui and open port 557 as a
>>>>>> custom TCP port.  Restarted sshd.  Still a failure.  hmmm.
>>>>>> Oh, is this the SELinux stuff that I would always disable?
>>>>>> Maybe this time I want to fight with SELinux instead of
>>>>>> just disabling it, but what to do here?  Help?
>>>>> You've messed up your system somehow, as normally you would
>>>>> be helped by setroubleshootd. And yes, there's at least one
>>>>> SELinux boolean related to this: setsebool -P
>>>>> sshd_forward_ports 1
>> Were you running setroubleshoot?  It should have told you something
>> like:
>>
>>> The first thing I did after the install was to open a terminal
>>> window, su, then gedit /etc/ssh/sshd_config&
>>> So if setroubleshoot was running it was running, I did nothing
>>> that I was asked to get it running.
>> # semanage port -a -t ssh_port_t -p tcp 557
>>
>>> Is this a command I am suppose to enter in a terminal window?
>> http://danwalsh.livejournal.com/9275.html
>
> Yes execute this as root.  This basically tells SELinux to treat port
> 557 as an ssh port.

That did the trick.  I will add this to my installation notes.  It sure 
took time for this command to run, though!