-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/08/2011 02:39 PM, Robert Moskowitz wrote: > On 12/08/2011 02:12 PM, Daniel J Walsh wrote: On 12/08/2011 12:14 > PM, Michael Schwendt wrote: >>>> On Thu, 08 Dec 2011 09:26:31 -0500, RM (Robert) wrote: >>>> >>>>> I have always run SSHD on a different port as part of my >>>>> obfusication. Yeah, I know it will not stop good >>>>> portscanners, but it stops all that stupid doorknocking on >>>>> port 22... >>>>> >>>>> So I changed sshd_config to use port 557 (not really, but >>>>> I'm not telling here) and enabled root login (yeah I know I >>>>> can get in and then do a su -, but perhaps I am a bit >>>>> lazy). And restarted sshd (service sshd restart). >>>>> >>>>> Will this got: >>>>> >>>>> Redirected to /bin/systemctl >>>>> >>>>> And then doing a service sshd status I see that it failed >>>>> with status=255. Oops perhaps the firewall, I did not open >>>>> port 557. >>>> No. The firewall settings would not stop sshd from >>>> listening. >>>> >>>>> So I go over to the firewall gui and open port 557 as a >>>>> custom TCP port. Restarted sshd. Still a failure. hmmm. >>>>> Oh, is this the SELinux stuff that I would always disable? >>>>> Maybe this time I want to fight with SELinux instead of >>>>> just disabling it, but what to do here? Help? >>>> You've messed up your system somehow, as normally you would >>>> be helped by setroubleshootd. And yes, there's at least one >>>> SELinux boolean related to this: setsebool -P >>>> sshd_forward_ports 1 > Were you running setroubleshoot? It should have told you something > like: > >> The first thing I did after the install was to open a terminal >> window, su, then gedit /etc/ssh/sshd_config & > >> So if setroubleshoot was running it was running, I did nothing >> that I was asked to get it running. > > # semanage port -a -t ssh_port_t -p tcp 557 > >> Is this a command I am suppose to enter in a terminal window? > http://danwalsh.livejournal.com/9275.html Yes execute this as root. This basically tells SELinux to treat port 557 as an ssh port. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk7hFCIACgkQrlYvE4MpobO3rACeMOaBDy3dD9SoS+4giH8PyNtW BvQAnjL+5lX2h/Ta3PfU7Oq+weCkJp0r =Y30m -----END PGP SIGNATURE----- -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
