Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Mac mini running OS X Server 10.11.6, CommuniGate Pro, and nearly no other stock OS X Server services.

Server's owner recently found himself on a network that blocked ports for both VPN connections and SSH, so we're trying to set up the server to allow for an SSH tunnel via SOCKS proxy to port 443, which is nearly always left open. (We have no plans on running web services over that port on this box.)

Research indicates this should be a two-step process: 1) edit /Library/Server/Web/Config/Proxy/apache_serviceproxy.conf to remove web listeners on ports 80 and 443; 2) edit /etc/ssh/ssh_config to add an SSH listener on port 443; then reboot.

Upon doing so, HTTP services indeed are turned off on 80 and 443, but I can't connect to SSH on port 443. Works fine over 22 still. Nmapping the server indicates that there's nothing open on port 443. Is there something else I need to do to open this up?

share|improve this question
up vote 1 down vote accepted

Here are steps to get SSH listening on port 443. Note that if you have SIP disabled, you can directly edit (as root) /System/Library/LaunchDaemons/ssh.plist and therefore can skip steps 1 and 3, and use the above path in steps 2 and 5. Note in that case you will want to run the unload command before editing ssh.plist.

  1. Copy the existing ssh.plist file into /Library:

    sudo cp /System/Library/LaunchDaemons/ssh.plist /Library/LaunchDaemons/ssh2.plist
    
  2. Edit the file as root:

    sudo nano /Library/LaunchDaemons/ssh2.plist
    
  3. There are two things that need to be changed. First is the <Label>. Change this:

    <key>Label</key>
    <string>com.openssh.sshd</string>
    

    To something like this:

    <key>Label</key>
    <string>com.openssh.sshd443</string>
    
  4. Next change this:

                    <key>SockServiceName</key>
                    <string>ssh</string>
    

    To this:

                    <key>SockServiceName</key>
                    <string>443</string>
    
  5. Save and then run this command to load the service:

    sudo launchctl load -w /Library/LaunchDaemons/ssh2.plist
    

    If you ever need to unload it, you can do so with:

    sudo launchctl unload /Library/LaunchDaemons/ssh2.plist
    
share|improve this answer
    
Excellent, thank you. I'll try this immediately. Should I edit the ssh_config file back to its original settings? Sounds like they're not being used. – Jeff Porten Sep 19 at 2:13
    
I don't believe it's used, but I'm not positive on that. – tubedogg Sep 19 at 2:14
1  
Works a charm. You rock. Thank you, both for the answer and for how quickly you wrote it up! – Jeff Porten Sep 19 at 2:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.