Fedora44 : SSH 、Firewalld

Contents

1.Configuring Remote Connections via SSH
- 1.1 Modifying the SSH Service Configuration File
2.Firewall (firewalld) settings
- 2.1 Command to check the status and settings of "firewalld
- 2.2 Release modified SSH port 2244
3.Remote connection from Windows

1.Configuring Remote Connections via SSH

Configure the default settings to increase the security of ssh connections.

1.1 Modifying the SSH Service Configuration File

To change the SSH service settings, edit the configuration file "/etc/ssh/sshd_config".

1	# vi /etc/ssh/sshd_config

#       $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $
# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.
# This sshd was compiled with PATH=/usr/local/bin:/usr/bin
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.
# To modify the system-wide sshd configuration, create a  *.conf  file under
#  /etc/ssh/sshd_config.d/  which will be automatically included below
Include /etc/ssh/sshd_config.d/*.conf
# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
Port 2244
#AddressFamily any
ListenAddress 0.0.0.0
#ListenAddress ::
#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key
# Ciphers and keying
#RekeyLimit default none
# Logging
#SyslogFacility AUTH
#LogLevel INFO
# Authentication:
#LoginGraceTime 2m
PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6

# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented. Uncommented options override the

# default value.

# To modify the system-wide sshd configuration, create a *.conf file under

# /etc/ssh/sshd_config.d/ which will be automatically included below

Include /etc/ssh/sshd_config.d/*.conf

# If you want to change the port on a SELinux system, you have to tell

# SELinux about this change.

# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER

Port 2244

#AddressFamily any

ListenAddress 0.0.0.0

#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying

#RekeyLimit default none

# Logging

#SyslogFacility AUTH

#LogLevel INFO

# Authentication:

#LoginGraceTime 2m

PermitRootLogin prohibit-password

#StrictModes yes

#MaxAuthTries 6

Line 21, "Port 22" This time change to "Port 2244" and proceed.
Delete "#" from line 23 "#ListenAddress 0.0.0.0".
Line 40, "#PermitRootLogin prohibit-password", delete "#".
Since the root user already knows the user name and can log in to the server with administrator privileges once the password is known, the setting is set to deny this.

Restarting SSH

1	# systemctl restart sshd.service

If this is not done, the next time you reboot, you will not be able to connect remotely via SSH. Please free SSH port 2244 in the following firewall settings.

2.Firewall (firewalld) settings

In Fedora, firewalld is set as the default firewall and is enabled during OS installation.

2.1 Command to check the status and settings of "firewalld

①Check firewalld operation status

1	# firewall-cmd --state

If "firewalld" is running, the message "running" will be displayed; if it is not running, the message "not running" will be displayed.

# systemctl status firewalld

● firewalld.service - firewalld - dynamic firewall daemon

Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: enabled)

Drop-In: /usr/lib/systemd/system/service.d

└─10-timeout-abort.conf

Active: active (running) since Thu 2026-04-30 08:05:00 JST; 14min ago

Invocation: a3e4514a6f454e0987863ce14a88f928

Docs: man:firewalld(1)

Main PID: 1150 (firewalld)

Tasks: 2 (limit: 3436)

Memory: 47.4M (peak: 47.5M)

CPU: 853ms

CGroup: /system.slice/firewalld.service

└─1150 /usr/bin/python3 -sP /usr/bin/firewalld --nofork --nopid

Apr 30 08:04:55 Lepard systemd[1]: Starting firewalld.service - firewalld - dynamic firewall daemon...

Apr 30 08:05:00 Lepard systemd[1]: Started firewalld.service - firewalld - dynamic firewall daemon.

※When stopped
Active: inactive (dead) is displayed, indicating that firewalld is stopped

➁About the "--permanent" option
To prevent the settings from disappearing when the server is restarted or the "firewalld" service is restarted, the
The "--permanent" option must be used to configure the settings.
If the "--permanent" option is specified, it is necessary to use "fiewall-cmd --reload" to reflect the settings, as they are not reflected in "firewalld" as they are.

Permanent use of HTTP service without initialization after system reboot

1 2	# firewall-cmd --add-service=http --permanent # firewall-cmd --reload

➂How to start/stop
Since "firewalld" is controlled by "systemd", use the "systemctl" command to start and stop it.

Starting firewalld

# systemctl start firewalld

Stopping firewalld

# systemctl stop firewalld

2.2 Release modified SSH port 2244

1 2	# firewall-cmd --add-port=2244/tcp --permanent # firewall-cmd --reload

3.Remote connection from Windows

Connect using the Tabby Terminal terminal emulator from Windows.
Specify the SSH port with the [-p 2244] option.

Clink v1.7.6.d9907d
Copyright (c) 2012-2018 Martin Ridgers
Portions Copyright (c) 2020-2024 Christopher Antos
https://github.com/chrisant996/clink

C:\Users\xxxxx>ssh huong@192.168.11.83 -p 2244
huong@192.168.11.83's password:　←User password
Web console: https://Lepard:9090/ or https://192.168.11.83:9090/
huong@Lepard:~$

Go to top