2

Mac mini running OS X Server 10.11.6, CommuniGate Pro, and nearly no other stock OS X Server services.

Server's owner recently found himself on a network that blocked ports for both VPN connections and SSH, so we're trying to set up the server to allow for an SSH tunnel via SOCKS proxy to port 443, which is nearly always left open. (We have no plans on running web services over that port on this box.)

Research indicates this should be a two-step process: 1) edit /Library/Server/Web/Config/Proxy/apache_serviceproxy.conf to remove web listeners on ports 80 and 443; 2) edit /etc/ssh/ssh_config to add an SSH listener on port 443; then reboot.

Upon doing so, HTTP services indeed are turned off on 80 and 443, but I can't connect to SSH on port 443. Works fine over 22 still. Nmapping the server indicates that there's nothing open on port 443. Is there something else I need to do to open this up?

Improve this question
1

Here are steps to get SSH listening on port 443. Note that if you have SIP disabled, you can directly edit (as root) /System/Library/LaunchDaemons/ssh.plist and therefore can skip steps 1 and 3, and use the above path in steps 2 and 5. Note in that case you will want to run the unload command before editing ssh.plist.

  1. Copy the existing ssh.plist file into /Library:

    sudo cp /System/Library/LaunchDaemons/ssh.plist /Library/LaunchDaemons/ssh2.plist

  2. Edit the file as root:

    sudo nano /Library/LaunchDaemons/ssh2.plist

  3. There are two things that need to be changed. First is the <Label>. Change this:

    <key>Label</key>
<string>com.openssh.sshd</string>

    To something like this:

    <key>Label</key>
<string>com.openssh.sshd443</string>

  4. Next change this:

                    <key>SockServiceName</key>
                <string>ssh</string>

    To this:

                    <key>SockServiceName</key>
                <string>443</string>

  5. Save and then run this command to load the service:

    sudo launchctl load -w /Library/LaunchDaemons/ssh2.plist

    If you ever need to unload it, you can do so with:

    sudo launchctl unload /Library/LaunchDaemons/ssh2.plist
Improve this answer
7
  • Excellent, thank you. I'll try this immediately. Should I edit the ssh_config file back to its original settings? Sounds like they're not being used. – Jeff Porten Sep 19 '16 at 2:13
  • I don't believe it's used, but I'm not positive on that. – tubedogg Sep 19 '16 at 2:14
  • 1
    Works a charm. You rock. Thank you, both for the answer and for how quickly you wrote it up! – Jeff Porten Sep 19 '16 at 2:20
  • I tried this on a MacBook Pro with Mojave 10.14.6, and the whole thing with creating and loading the new daemon (in the global library, not the system library) worked fine, but when I try to connect to the Mac using my iPhone with Panic's Prompt 2, the connection fails. I'm trying to directly connect to the IP address, but my AP/router is still sitting inbetween. Do I need to give my Mac something like a DynDNS domain name for this to work? – JayB May 3 '20 at 19:12
  • 1
    @JayB Your router is dropping the packets since it's not clear where they're intended to go (they're not in response to a request made by a computer inside the network). You need to set up port forwarding on the router for port 443 to the appropriate computer inside your network so your router knows where the packets are supposed to be delivered. – tubedogg Jun 17 '20 at 21:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .