SSH fails after Port change on CentOS 7

Question

After changing the port.

And restarting the SSH service, it failed on me.

I got the following info when I ran systemctl status sshd.service:

sshd.service: main process exited, code=exited, status=255/n/a
Unit sshd.service entered failed state.
sshd.service failed.

Any suggestions on how do I fix this (newb here)?

@Orphans Port 977...opened the firewall and everything but it doesn't work. — Nikk, Feb 22 '17 at 15:00
Ports under 1000 is reserved for other services, set it to 1000 or higher. — Orphans, Feb 22 '17 at 15:06
http://unix.stackexchange.com/questions/10735/linux-allowing-an-user-to-listen-to-a-port-below-1024 — Orphans, Feb 22 '17 at 15:08
Did you adjust the SELinux policy as the comment in the configuration file hints? — Jakuje, Feb 22 '17 at 15:13
@Jakuje I'm not really sure how to setup `setcap 'cap_net_bind_service=+ep' /path/to/program` to work for sshd. Can you help? — Nikk, Feb 22 '17 at 16:47
No. That is something different. It says: *If you want to change the port on a SELinux system, you have to tell SELinux about this change.* `# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER` — Jakuje, Feb 22 '17 at 16:56
Whatever Orphans said doesn't apply here, and you should stop trying to do that. It will not solve your problem. @Jakuje appears to have figured out the issue. — Michael Hampton, Feb 22 '17 at 17:28
@MichaelHampton Like this: `semanage port -a -t ssh_port_t -p tcp 977`? — Nikk, Feb 22 '17 at 17:34
Yes, that should do the job. Run it as a root and try to restart the service again. — Jakuje, Feb 22 '17 at 17:42

score 11 · Accepted Answer · answered Feb 22 '17 at 18:07

To allow sshd running on different port than default 22, you need to adjust SELinux policy, otherwise it will be blocked from binding the port. The procedure is explained just few lines above the line you were changing in sshd_config:

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER

Therefore in your case, just run from root shell (or with sudo):

semanage port -a -t ssh_port_t -p tcp 977

and then try to restart the service again. If it will not solve your problems, have a look into the logs and update the question.

I'm having the same issue as the OP on Centos 7.5 but semanage wasn't found; solution is to install `policycoreutils-python` yum install policycoreutils-python [https://www.ostechnix.com/linux-troubleshooting-semanage-command-not-found-in-centos-7rhel-7/](https://www.ostechnix.com/linux-troubleshooting-semanage-command-not-found-in-centos-7rhel-7/) — user16081-JoeT, Oct 29 '18 at 16:49

SSH fails after Port change on CentOS 7

1 Answers1