On 12/08/2011 02:46 PM, Daniel J Walsh wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 12/08/2011 02:39 PM, Robert Moskowitz wrote: >> On 12/08/2011 02:12 PM, Daniel J Walsh wrote: On 12/08/2011 12:14 >> PM, Michael Schwendt wrote: >>>>> On Thu, 08 Dec 2011 09:26:31 -0500, RM (Robert) wrote: >>>>> >>>>>> I have always run SSHD on a different port as part of my >>>>>> obfusication. Yeah, I know it will not stop good >>>>>> portscanners, but it stops all that stupid doorknocking on >>>>>> port 22... >>>>>> >>>>>> So I changed sshd_config to use port 557 (not really, but >>>>>> I'm not telling here) and enabled root login (yeah I know I >>>>>> can get in and then do a su -, but perhaps I am a bit >>>>>> lazy). And restarted sshd (service sshd restart). >>>>>> >>>>>> Will this got: >>>>>> >>>>>> Redirected to /bin/systemctl >>>>>> >>>>>> And then doing a service sshd status I see that it failed >>>>>> with status=255. Oops perhaps the firewall, I did not open >>>>>> port 557. >>>>> No. The firewall settings would not stop sshd from >>>>> listening. >>>>> >>>>>> So I go over to the firewall gui and open port 557 as a >>>>>> custom TCP port. Restarted sshd. Still a failure. hmmm. >>>>>> Oh, is this the SELinux stuff that I would always disable? >>>>>> Maybe this time I want to fight with SELinux instead of >>>>>> just disabling it, but what to do here? Help? >>>>> You've messed up your system somehow, as normally you would >>>>> be helped by setroubleshootd. And yes, there's at least one >>>>> SELinux boolean related to this: setsebool -P >>>>> sshd_forward_ports 1 >> Were you running setroubleshoot? It should have told you something >> like: >> >>> The first thing I did after the install was to open a terminal >>> window, su, then gedit /etc/ssh/sshd_config& >>> So if setroubleshoot was running it was running, I did nothing >>> that I was asked to get it running. >> # semanage port -a -t ssh_port_t -p tcp 557 >> >>> Is this a command I am suppose to enter in a terminal window? >> http://danwalsh.livejournal.com/9275.html > > Yes execute this as root. This basically tells SELinux to treat port > 557 as an ssh port. That did the trick. I will add this to my installation notes. It sure took time for this command to run, though! -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
