Fedora43 : SSH 、Firewalld

Contents

1.Configuring Remote Connections via SSH
- 1.1 Modifying the SSH Service Configuration File
2.Firewall (firewalld) settings
- 2.1 How to use the "firewall-cmd" command to control "firewalld
- 2.2 Release modified SSH port 2244
3.Remote connection from Windows

1.Configuring Remote Connections via SSH

SSH is a service for connecting remotely to a server, basically running immediately after OS installation, but the default settings are somewhat insecure.
Configure the default settings to increase the security of ssh connections.

1.1 Modifying the SSH Service Configuration File

The SSH service configuration file is "/etc/ssh/sshd_config".
Open the configuration file in a vi editor.

# vi /etc/ssh/sshd_config

1	# vi /etc/ssh/sshd_config

#       $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

# To modify the system-wide sshd configuration, create a  *.conf  file under
#  /etc/ssh/sshd_config.d/  which will be automatically included below
Include /etc/ssh/sshd_config.d/*.conf

# If you want to change the port on a SELinux system, you have to tell
# SELinux about this change.
# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
#
Port 2244
#AddressFamily any
ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6

# $OpenBSD: sshd_config,v 1.105 2024/12/03 14:12:47 dtucker Exp $

# This is the sshd server system-wide configuration file. See

# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/bin:/usr/bin

# The strategy used for options in the default sshd_config shipped with

# OpenSSH is to specify options with their default value where

# possible, but leave them commented. Uncommented options override the

# default value.

# To modify the system-wide sshd configuration, create a *.conf file under

# /etc/ssh/sshd_config.d/ which will be automatically included below

Include /etc/ssh/sshd_config.d/*.conf

# If you want to change the port on a SELinux system, you have to tell

# SELinux about this change.

# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER

Port 2244

#AddressFamily any

ListenAddress 0.0.0.0

#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key

#HostKey /etc/ssh/ssh_host_ecdsa_key

#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying

#RekeyLimit default none

# Logging

#SyslogFacility AUTH

#LogLevel INFO

# Authentication:

#LoginGraceTime 2m

PermitRootLogin prohibit-password

#StrictModes yes

#MaxAuthTries 6

Line 21, "Port 22" This time change to "Port 2244" and proceed.
Delete "#" from line 23 "#ListenAddress 0.0.0.0".
Line 40, "#PermitRootLogin prohibit-password", delete "#".
Since the root user already knows the user name and can log in to the server with administrator privileges once the password is known, the setting is set to deny this.

Restarting SSH

# systemctl restart sshd.service

1	# systemctl restart sshd.service

If this is not done, the next time you reboot, you will not be able to connect remotely via SSH. Please free SSH port 2244 in the following firewall settings.

2.Firewall (firewalld) settings

In Fedora, firewalld is set as the default and is enabled during OS installation.

2.1 How to use the "firewall-cmd" command to control "firewalld

1)Command to check the status and settings of "firewalld

①Check firewalld operation status

# firewall-cmd --state

1	# firewall-cmd --state

If "firewalld" is running, the message "running" will be displayed; if it is not running, the message "not running" will be displayed.

# systemctl status firewalld

● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: enabled)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: active (running) since Fri 2025-10-31 11:21:08 JST; 15min ago
 Invocation: bbfda1ccc1274cee8e5992214d25b8d0
       Docs: man:firewalld(1)
   Main PID: 867 (firewalld)
      Tasks: 4 (limit: 4532)
     Memory: 48.4M (peak: 72.8M)
        CPU: 1.044s
     CGroup: /system.slice/firewalld.service
             └─867 /usr/bin/python3 -sP /usr/bin/firewalld --nofork --nopid

Oct 31 11:21:06 Lepard systemd[1]: Starting firewalld.service - firewalld - dynamic firewall daemon...
Oct 31 11:21:08 Lepard systemd[1]: Started firewalld.service - firewalld - dynamic firewall daemon.

# systemctl status firewalld

● firewalld.service - firewalld - dynamic firewall daemon

Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: enabled)

Drop-In: /usr/lib/systemd/system/service.d

└─10-timeout-abort.conf

Active: active (running) since Fri 2025-10-31 11:21:08 JST; 15min ago

Invocation: bbfda1ccc1274cee8e5992214d25b8d0

Docs: man:firewalld(1)

Main PID: 867 (firewalld)

Tasks: 4 (limit: 4532)

Memory: 48.4M (peak: 72.8M)

CPU: 1.044s

CGroup: /system.slice/firewalld.service

└─867 /usr/bin/python3 -sP /usr/bin/firewalld --nofork --nopid

Oct 31 11:21:06 Lepard systemd[1]: Starting firewalld.service - firewalld - dynamic firewall daemon...

Oct 31 11:21:08 Lepard systemd[1]: Started firewalld.service - firewalld - dynamic firewall daemon.

※When stopped
Active: inactive (dead) is displayed, indicating that firewalld is stopped

➁About the "--permanent" option
To prevent the settings from disappearing when the server is restarted or the "firewalld" service is restarted, the
The "--permanent" option must be used to configure the settings.
If the "--permanent" option is specified, it is necessary to use "fiewall-cmd --reload" to reflect the settings, as they are not reflected in "firewalld" as they are.

Permanent use of HTTP service without initialization after system reboot

# firewall-cmd --add-service=http --permanent
# firewall-cmd --reload

1 2	# firewall-cmd --add-service=http --permanent # firewall-cmd --reload

➂How to start/stop
Since "firewalld" is controlled by "systemd", use the "systemctl" command to start and stop it.

Starting firewalld
# systemctl start firewalld
Stopping firewalld
# systemctl stop firewalld

Starting firewalld

# systemctl start firewalld

Stopping firewalld

# systemctl stop firewalld

2.2 Release modified SSH port 2244

# firewall-cmd --add-port=2244/tcp --permanent
# firewall-cmd --reload

1 2	# firewall-cmd --add-port=2244/tcp --permanent # firewall-cmd --reload

3.Remote connection from Windows

Connect using the Tabby Terminal terminal emulator from Windows.
Specify the SSH port with the [-p 2244] option.

Clink v1.7.6.d9907d
Copyright (c) 2012-2018 Martin Ridgers
Portions Copyright (c) 2020-2024 Christopher Antos
https://github.com/chrisant996/clink

C:\Users\xxxxx>ssh huong@192.168.11.83 -p 2244
ssh: connect to host 192.168.11.83 port 22: Connection refused
huong@192.168.11.83's password:　←User password
Web console: https://Lepard:9090/ or https://192.168.11.83:9090/

Last login: Fri Oct 31 11:21:51 2025 from 192.168.11.6
huong@Lepard:~$

Go to top