CentOS 6.4 Modify SSH default port 22 for additional ports exhaustive security tutorial (includes selinux,iptables settings) __linux

This tutorial is currently the safest tutorial, if you are novice please follow the steps of the tutorial strictly, if there is a certain basis for people can selectively skip certain paragraphs modify port configuration

Run first

Vim/etc/ssh/sshd_config

Find #port 22 and remove the previous comment, then add a line of Port 1234 below.

Port
Port 1234

Many tutorials are directly modified 22 for other ports, it is best not to do so, in case the modified port can not be used, you can not fully login, so leave a posterior

Modify Firewall Configuration

To modify the Iptables (Linux firewall) file:

Vim/etc/sysconfig/iptables

Add one line

Iptables-a input-m State--state new-m tcp-p TCP--dport 1234-j ACCEPT

Shutdown Firewall

Then close the firewall

Service Iptables Stop

Close SELinux

Important: Close SELinux first, many tutorials do not mention this, because the SELinux default protection level is very high, if not close SELinux will be a lot of problems

Vim/etc/sysconfig/selinux

Modify the selinux=enforcing line to selinux=disabled and reboot.

Test Connection

Run command after reboot:

NETSTAT-TPNL | grep ssh

You'll see two ports open at the same time.

[Root@localhost ~]# NETSTAT-TPNL | grep ssh
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1497/sshd           
tcp        0      0 0.0.0.0:1234                 0.0.0.0:*                   LISTEN      1497/sshd           
tcp        0      0:::                       ::*                        LISTEN      1497/sshd           
tcp        0      0: :: 1234                      :::*                        LISTEN      1497/sshd    

Important: Test if the new port is connected through

Modify SELinux Configuration

If the following steps are normal: Modify the SELinux

Just installed CentOS is not semanage command, so please confirm the existence of semanage command, if not, follow the following tutorial installation

# Rpm-qa | grep semanag libsemanage-2.0.43-4.2.el6.x86_64 # which Semanage/usr/bin/which:no Semanag E in (/usr/lib64/qt-3.3/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin) # YUM provides/ 
Usr/sbin/semanage policycoreutils-python-2.0.83-19.30.el6.x86_64:selinux Policy Core python utilities repo:base Matched From:filename:/usr/sbin/semanage # yum Whatprovides/usr/sbin/semanage Loaded Plugins:fastestmirror, REFR Esh-packagekit, Loading mirror speeds from cached Hostfile * base:mirrors.prometeus.net. CH * extras:mirrors.prometeus.net * rpmfusion-free-updates:rpmfusion.famillecollet.com * rpmfusion-nonfree-updates:r pmfusion.famillecollet.com * Updates:mirrors.prometeus.net Policycoreutils-python-2.0.83-19.30.el6.x86_64:selinux Policy core Python utilities repo:base matched from:filename:/usr/sbin/semanage # yum-y Install Eutils-python 

When you are done, use the following command to view the current SELinux allowed SSH ports:

Semanage Port-l | grep ssh

Will output

ssh_port_t                     TCP      22

Add Port 1234 to SELinux

Semanage port-a-t ssh_port_t-p TCP 1234

Important: Then confirm whether to add it

Semanage Port-l | grep ssh

If success will output

ssh_port_t                     TCP      1234, 22

open SELinux lower security level

Then modify the SELinux policy and reopen it, but we'll change it to permissive. This security level will not intercept your modifications, just prompt for warnings

Vim/etc/sysconfig/selinux

Modify Security Level

Selinux=permissive

Then reboot reboot.

Important: Reboot once again with new port test remote connection open SELinux normal security level

Test the connection with the new port after reboot

If the test is modified selinux=enforcing, and then restarted, because the way we said so many times before, there is no code here.

Once again, test the remote connection follow up step with the new port after reboot

If you can, congratulations, successfully configured the new port, and then you can do your own 22 ports from the Sshd_config, remove the 22 port from the firewall and other steps