How to change the default port and disable root login for SSH on Red Hat Enterprise Linux (RHEL/CENTOS 7 & 8)

This tutorial is focused on what SSH is, how to change SSH port from default 22 to the desired port and why you may want to consider to change the port. It also guides you on how to disable the root login for SSH

UNDERSTANDING THE SUBJECT MATTER

SSH means secure shell, From the word secured, it is a network protocol that allows a remote connection to a server securely.

Not to go out of the scope of this study, I will briefly talk on the history of SSH.

Prior to using the SSH protocol, telnet known as Telecommunications and Networks was formerly used to remotely log into servers, it uses a default port 23 and it’s best used for Unix-like operating systems. To login into a Linux server using telnet, the telnet command can simply be launched from the windows command line by typing

   telnet <hostname>  or telnet  <IP address of the server>. 

For example, if you had to connect to a Linux system with the IP address 10.10.10.22, you need to type the following command at the command line.
<telnet 10.10.10.22>, a login prompt to type the login username and password will be displayed and if authenticated, you will be connected to the server.

However, as the years go by and technology began to advance, the telnet protocol became unsecured because it doesn’t use any security algorithm to transfer data, no form of encryption, it just transfers data in a plain text and hackers uses this medium to get vital information including usernames and passwords. Hence why the SSH protocol was developed in the year 1995 by Tatu Ylonen, a native of Finland when his university network became a victim of a password sniffing attack to replace telnet and other unsecured protocols like rsh, rlogin and the likes.

---

The SSH protocol is the most used network protocol for a remote connection. It uses a default port 22 and has an encryption mechanism incorporated into it. So when there is communication between two servers via SSH, the transferred data is protected which prevents sniffing and any other form of other unpleasant activities. SSH has a lot of features and flexibility.

---

The SSH configuration files is found in “/etc/ssh”

The SSH default port and disabling of the root login for SSH can be changed in the /etc/ssh/sshd_config file

---

The first time the client (SSH client) tries to connect to the remote server (SSH server), the ssh service (sshd daemon) on the server is notified on the incoming request.

More so, the client probes the server to prove it’s identity, for the identity to be proven, the key fingerprint which is the public key found in the /etc/ssh/ssh_host.pub file on the server is immediately sent to the client in this format,

Because it is the first time both systems will be connecting, the client will not recognize the public keys. However, a warning message is given as displayed in the format above.

"Are you sure you want to continue (yes/no)? yes

if the client is sure she wants to connect, the client type “yes” to continue and the public key is immediately stored on the client’s home directory in the file (~/.ssh/known_hosts).

More so, the server also needs to verify it’s identity from the client by telling the client to input the password, if the account (credentials) is verified and correct, authentication to the server will be possible but if the credential is wrong, authentication to the server will be denied.

This is one of the security mechanisms used by SSH.

The second time the clients want to connect to the server, since the public key is already stored by the client for the first time, the client does not require the server to prove it’s identity anymore and the client will only be prompted to input the server’s credentials for authentication.

now let’s practical by trying to login to a remote server via the SSH protocol

---

To remotely connect to a Linux server, you use the command ssh. For example, if you want to connect remotely to server B (rhel7) from server A (rhel8), you will need to do the following.

                     
  ssh <username@server's-IP>

And boom!!! you are in.

---

What if your server is configured to use a port number different from the default port 22. For example, if you want to connect remotely to server B (rhel8) that is using SSH port 2019 from server A (rhel7), you will need to do the following.

                     ssh -p <port-no> <username@server's-IP>

you can use the command ssh –help to get more options

---

To connect to a Linux server via SSH from a Windows machine, you will need an SSH client application like Putty, Bitvise, etc. Personally, I use putty or bitvise.
You can download putty via this link . https://www.putty.org/ (About 3.5mb)

After downloading, you will need to

The major reason the SSH default port is most times changed by administrators is to tighten the security of the server more especially when the server is internet facing. Virtually every Tech person knows the SSH default port including the bad guys (hackers), though SSH is secured but to double secure your environment, the SSH default port 22 can be changed to any desired port. In the “ACTION TIME” section, the SSH default port was changed to port 2019.

More so, the root login can be disabled for SSH. These actions are for security purposes. In the advent of a brute force attack, the attacker will not have the full rights and privileges for any unpleasant activities. Hence, damages may be limited.

---

ACTION TIME

STEPS

1. Confirm the sshd service status

# systemctl status sshd

2. Edit the /etc/ssh/sshd_config file. Search for Port 22 and add the new port immediately after.

# vi /etc/ssh/ssshd_config

3. Add the new port to the firewall rule

# firewall-cmd –add-port=2019/tcp –permanent

4. restart the firewall service.

# systemctl restart firewalld.service

5. Manage the SELinux policy by adding the new port to the SSH program for SELinux .

# semanage port –a –t ssh_port_t –p tcp 2019

6. verify the type context to see if port 2019 is allowed

# semanage port –list |grep 2019

7. Restart the ssh service

# systemctl restart sshd.service

8. Login with the new port.

STEPS

1. Edit the /etc/ssh/sshd_config file. Search for the line PermitRootLogin and change yes to no.

# vi /etc/ssh/ssshd_config

2. Restart the ssh service.

# systemctl restart sshd.service

3. Login as root and access will be denied.