karolb
By:
karolb

How to change SSH port and firewall rule?

January 5, 2018 208 views
Security DigitalOcean Articles

Hi, I have set up a different port for SSH(same way as it is described in the deprecated article) and custom firewall rule [TCP, all IP4/6] limited to the same port. I still can't get connection[ssh: connect to host xx.xx.xx.xx port xxxx: Connection timed out]. What is the problem?

1 Answer

To change the port ssh works on, edit /etc/ssh/sshd_config and edit the line "Port 22" to be a different port.
Then restart sshd ("sudo service ssh restart")
You can then test whether ssh is working on that port with "ssh localhost -p 1234" or whatever your new port is.

If that works, but remotely doesn't work it's probably the firewall issue.
How do you have your firewall set up?
The firewall from Digital Ocean's control panel? UFW? IPTables?

  • I've used DO's control panel.
    This is the output of $sudo ssh localhost -p xxxx typed in DO's access console:

    The authenticity of host '[localhost]:xxxx ([127.0.0.1]:xxxx)' can't be established.
    ECDSA key fingerprint is SHA256xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
    Are you sure you want to continue connecting(yes/no)? yes
    Warning: Permanently added '[localhost]:xxxx' (ECDSA) to the list of known hosts.
    Permission denied (publickey).
    

    Should I add host with new port to the list of known hosts on my machine?

    • $ ssh localhost -p xxxx
      

      gives exacly same results plus it can't create home/user/.ssh dir and add host to the list of known hosts

    • That just means that you haven't set up your ssh key for your user on your droplet. It's shown that you have connected to the ssh server on port xxxx.

      For the Firewall, you should set an Inbound rule. Type: Custom, Protocol:TCP, Port Range:XXXX, Sources: All ipV4

Have another answer? Share your knowledge.