How to run the SSH server on a port other than 22

Question

I have two computers behind the same router. Let's call them A and B.

A can SSH to B in the following manner: ssh usr@<internal ip of computer>

B can SSH to A by doing the same, but the external IP must be used. I have forwarded port 22 of my router to the IP of computer A, so that all makes sense to me.

However, I want to also forward port 26 to computer B, and SSH from outside the network by using the external IP for both, but specifying either port 22 or 26, to effectively select which computer to use.

I have tried allowing port 26 through OUTPUT of iptables on A and INPUT of B, but that didn't seem to work. I have also forwarded port 26 to the internal IP of B (through the router), as I did with 22 for A.

Here's what I get when I try to SSH from A to B using the external IP and port 26:

ssh: connect to host xx.xx.xxx.xx port 26: Connection refused.

Versions:

A = OpenSSH_5.9p1 Debian-5ubuntu1, OpenSSL 1.0.1 14 Mar 2012
B = OpenSSH_6.0p1 Debian-4, OpenSSL 1.0.1c 10 May 2012

A has 12.04 Ubuntu, B is a Raspberry Pi with Raspbian.

EDIT: Something that I forgot to put in: I did try switching the SSH config file (I found it is /etc/ssh/ssh_config) I uncommented (deleted the #) the line with Port and changed 22 to 26. It gave me the connection refused message still. (I rebooted to no avail.)

Do yuu ohave SSH running on port 22 or 26 on the second machine? — Nerdfest, Mar 04 '13 at 22:49
Note that /etc/ssh/ssh_config is the ssh client config. Where as /etc/ssh/sshd_config is the ssh daemon config. — steakunderscore, May 02 '13 at 01:23

Shiv Singh · Answer 1 · 2016-08-22T05:05:49.333

650

If you are on Linux system and you want connect to an SSH server on port 26 you can use the following command.

ssh user@192.168.1.1 -p 26

Note:

Replace server IP with the IP Address or DNS name of your server.
Change your port number as you have set.
if you are using custom port SSH then same port most be allowed for outbound, inbound connection on firewall otherwise the connection will not establish

edited Aug 22 '16 at 05:05

answered Aug 12 '15 at 12:48

Shiv Singh

6,733

17

No this is NOT the correct answer. OP had trouble with daemon not listening on desired port. He clearly asked for help with SSH server and/or NAT configuration, but current answer ignores original post and describes client command option already known to OP. I wonder how this answer got so many upvotes. – nnovich-OK May 04 '18 at 07:29
8

This is correct to the majority, but this isn't correct to OP's problem. – Ultrasonic54321 Feb 15 '19 at 13:54
1

But but manual says: .... [user@]host[:port]] ....
Did I miss something?
– Daddy32 Apr 04 '19 at 19:27
1

I would not say the OP "clearly asked..." his question, and to me, it appeared that he had problems connecting to port 26. It seemed like he wanted to differentiate the two by specifying a different port for each. It wasn't clear whether the client or server was the issue. – Marty Fried Jan 28 '20 at 23:45
1

Thank you for your post - it was what I was looking for. Note to @Daddy32: what you're missing is trying that format. It doesn't work on my system, but the -p option does. – Marty Fried Jan 28 '20 at 23:48
Worked perfectly for my Azure VMs behind public load balancer having custom NAT rule with different Port. – RSW Feb 22 '23 at 08:12

score 89 · Accepted Answer · edited Jun 02 '20 at 08:38

89

It seems like you're not running SSH on port 26 on the second machine. You can either change the port number on that machine to 26.

Either edit /etc/ssh/sshd_config & don't forget to restart SSH (service sshd restart) or leave it on 22, but forward port 26 on the router to port 22 on the second machine. Also, don't forget to change any firewall settings on the second machine to allow the connections through.

edited Jun 02 '20 at 08:38

Mahsa2

353

answered Mar 04 '13 at 22:53

Nerdfest

4,628

2

Ahhh...so sshd_config must change, not ssh_config? – Gary Mar 04 '13 at 23:26
5

Correct. sshd is the service (d is for daemon). Edit the config file (with sudo gedit), then restart the service with "sudo service ssh restart". – Nerdfest Mar 05 '13 at 05:11
2

Solved the problem. Didn't have to change any firewall settings either. – Gary Mar 05 '13 at 13:28
1

How to do the forward solution on the router from port 26 to 22? – Shadi Alnamrouti Aug 10 '21 at 22:33
Unit sshd.service could not be found. – Grim Mar 23 '24 at 06:56

score 13 · Answer 3 · answered Feb 08 '19 at 19:02

13

As I've explained in a related answer, ssh client allows specifying URI format as ssh://user@host:1234. For example:

ssh  ssh://myuser@mydomain.com:2222

where 2222 is the port number. Substitute the port number which you intend to use instead. Of course, remember that in order to connect to the specified port ssh server (on the host to which you are trying to connect) has to listen on the specified port in the first place

answered Feb 08 '19 at 19:02

Sergiy Kolodyazhnyy

105,154
20
279
497

What ssh client do you use? Doesn't work on Linux Mint's bash shell. You need to use "ssh host -p port". – Marty Fried Jan 28 '20 at 23:51
1

@MartyFried Hi , sorry for delayed response. What I use is OpenSSH_7.7p1 Debian-2, OpenSSL 1.0.2o 27 Mar 2018 I'm not aware what Linux Mint uses, but this page https://community.linuxmint.com/software/view/openssh-client says it's a "portable implementation" so may in fact differ. – Sergiy Kolodyazhnyy Feb 09 '20 at 03:31
No problem. Mint uses OpenSSH 7.6 Ubuntu, but I see patches from Debian, so I don't know about differences. I followed your link to the OpenSSH BSD man page (https://man.openbsd.org/ssh), and it looks about the same as the one I have. Too bad, as it would be nice if it used that same format as ftp port specification. – Marty Fried Feb 11 '20 at 03:25
I was curious, so I searched more and found this web page (https://linux.die.net/man/1/ssh) from a much older version that looks to be the same, but it shows the format that you used. Interesting, but I don't know what it means. :-) – Marty Fried Feb 11 '20 at 03:31
The great thing about this solution is that you can encode all information (user name, server name, port and even the password) in one string. – Manu CJ Jan 03 '21 at 16:38

score 13 · Answer 4 · edited Jun 12 '19 at 09:27

I use port 22 only for the intranet ssh access.

For access via internet I use a custom (unusual) port. This has the benefit the I reduce the load produced generated by script kids who are scanning port 22 for "well known usernames".

The external sshd processes are controlled by xinetd and running in parallel to the internal sshd process. In the following example I use the port 12345:

You are free to change this to any available free port number on your system. Maybe a higher value will make it also a bit more unlikely that this port is scanned by a "quick port scan".

The xinetd configuration is:

service ssh-external
{
    socket_type = stream
    wait = no
    protocol = tcp
    type = UNLISTED
    user = root
    server = /usr/sbin/sshd
    server_args = -i -f  /etc/ssh/external-sshd.config
    port = 12345
    log_on_failure += USERID
}

The file /etc/ssh/external-ssdh.config can be a copy of your usual sshd configuration. Ensure that the following statements are configured:

Port 12345
AddressFamily inet

I also suggest to enforce public key authentication and disable password authentication for the internet access:

PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no

score 10 · Answer 5 · answered Feb 28 '17 at 06:33

10

Listen ports also can be hard linked to IP addresses

/etc/ssh/sshd_config:

ListenAddress 10.10.10.10:22
ListenAddress 20.20.20.20:4444

answered Feb 28 '17 at 06:33

OasisInDesert

101

this should be a comment not an answer. – Pablo Pazos Oct 23 '18 at 01:10

Pablo Bianchi · Answer 6 · 2022-10-14T18:29:57.533

It is not a good idea to run ssh on default port (TCP/22), neither forward from WAN IP 22 to whatever port is using ssh-server on LAN IP.

To make ssh-server listen on any given port you have to

Edit on /etc/ssh/sshd_config (note the d) from #Port 22 to Port 26. Ie, uncomment and change the port. Better than 26 would be something randomly above (below 65535), like 42895.
Also consider changing to PermitRootLogin no.
Test your configuration with ssh test mode
```
sudo sshd -t
```
Restart ssh-server service
```
 sudo systemctl restart sshd.service
```

Then from ssh-client you will be able to connect

ssh user@serverNameOrIP -p 42895

Bonus: `mosh`

Mosh (mobile shell) Remote terminal application that allows roaming, supports intermittent connectivity, and provides intelligent local echo and line editing of user keystrokes.. Mosh is a replacement for interactive SSH terminals. It's more robust and responsive, especially over Wi-Fi, cellular, and long-distance links.

If mosh package is installed on server you can then use

mosh --ssh="ssh -p 42895" serverNameOrIP

score 1 · Answer 7 · answered Jun 28 '22 at 19:52

Two approaches.

You don't need to make any changes to your SSH configuration on either machine. If you set up port-forwarding on your router you can forward traffic from any public port on the router to port 22 on the computer. Use a different port forwarded to port 22 on the other machine. Unless you have a good reason to do it you should avoid opening port 22 on your external IP address. It makes you a target.

The other option is simply to SSH into one of the machines then SSH from there to the other.

How to run the SSH server on a port other than 22

7 Answers7

Bonus: `mosh`

Linked

How to run the SSH server on a port other than 22

7 Answers7

Bonus: mosh

Linked

Bonus: `mosh`