1

New installation of RHEL8 with openssh-server installed, enabled, and running.

firewall-cmd shows service ssh is added:

[[email protected] ]# firewall-cmd --list-services
cockpit ssh

netstat -anp | grep 22 shows the server is listening over 0:0:0:0:22

service sshd status shows the same (listening on port 22)

nmap -sSV -O -p 22 localhost (issued from new.rhel.server) shows that port 22 is open.

I am able to ssh localhost on new.rhel.server successfully. The server has internet connectivity.

When I try to ssh [email protected], I get an immediate Connection Refused error.

me@laptop ~ $ ssh -vvv new.rhel.server
OpenSSH_8.2p1 Ubuntu-4ubuntu0.5, OpenSSL 1.1.1f  31 Mar 2020
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolving "new.rhel.server" port 22
debug2: ssh_connect_direct
debug1: Connecting to new.rhel.server [1.2.3.4] port 22.
debug1: connect to address 1.2.3.4 port 22: Connection refused
ssh: connect to host new.rhel.server port 22: Connection refused

nmap -sSV -O -p 22 new.rhel.server (issued from my laptop) shows that port 22 is actually closed:

Starting Nmap 7.80 ( https://nmap.org ) at 2022-09-21 17:27 EDT
Nmap scan report for new.rhel.server (1.2.3.4)
Host is up (0.000051s latency).

PORT   STATE  SERVICE VERSION
22/tcp closed ssh
Too many fingerprints match this host to give specific OS details
Network Distance: 0 hops

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.05 seconds

This has me stumped. Why would nmap show the port is closed while the server reports that the port is open?

1
  • Ah, I didn't realize. I've deleted the comment.
    – Sotto Voce
    Sep 22, 2022 at 18:04

1 Answer 1

Reset to default
0

This is now working. For unknown reasons, the Port line in sshd_config was commented out.

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

Changing that to

#
Port 22
#AddressFamily any

then restarting sshd fixed this issue.

This was a fresh installation of RHEL, not sure why the Port line was commented out by default.

3
  • 1
    RHEL was being security conscious, having lockout of security holes by default, forcing admin awareness of actions to deliberatly expose the OS to remote penetration. Some experts have suggested to change the default port from 22 to something else, if you intend to keep open at all times, as a method to make it that much harder for outsider blackhats to circumvent security. As for insider abuse, nothing you can do to prevent that.
    – Eric Marceau
    Sep 22, 2022 at 19:02
  • Isn't changing the port # to a diff number basically security by obfuscation?
    – a coder
    Sep 25, 2022 at 12:23
  • Yes. It is one of many tools available. One would not use that by itself. It would be used in parallel with other tools.
    – Eric Marceau
    Sep 25, 2022 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .