Can hosts in a cluster run over a non-standard SSH port (i.e. not 22)

[yatesco]

Title says it all really.

The hosts will be on the public net so I don't want SSH running on port 22. Is this possible? The machines will all be in a single cluster.

Many thanks,

Col

 

[dietmar]

please use a firewall (or iptables) (and reasonable /etc/hosts.allow, /etc/hosts.deny)

 

[udo]

Hi,
you can also use fail2ban (i haven't tried it with proxmox - but if remember right, there a posting or a wiki-entry about this).
fail2ban with secure passwords should be ok.

Udo

 

[Nemesiz]

Edit /etc/ssh/sshd_config file to change port

 

[yatesco]

Hi all - thanks for your suggestions. I realise I can change the port and how to lock it down etc. My question is does proxmox clustering assume that it will be port 22 anywhere, and if so can I change it?

Has anybody got a cluster running on a different port, and what did they have to do?

To be transparent - I haven't tried it yet - I only have a production machine available to me and I want to know if I am about to break it I have experience with clustering proxmox but that was over 22....

 

[yatesco]

Hmm, it appears it cannot - I edited both /etc/ssh/sshd_config to port 222, rebooted and then watched lost of synchronisation errors because the machines couldn't connect to localhost 10050 (or something like that). Changing back to 22 works fine.

 

[dietmar]

Hmm, it appears it cannot - I edited both /etc/ssh/sshd_config to port 222, rebooted and then watched lost of synchronisation errors because the machines couldn't connect to localhost 10050 (or something like that). Changing back to 22 works fine.

Maybe yo also need to modify the port in /etc/ssh/ssh_config

 

[yatesco]

Nice one Dietmar - indeed. You need to change the port in both /etc/ssh/ssh_config and /etc/ssh/sshd_config.