Unable to SSH to OS X Server over alternate port

Question

Mac mini running OS X Server 10.11.6, CommuniGate Pro, and nearly no other stock OS X Server services.

Server's owner recently found himself on a network that blocked ports for both VPN connections and SSH, so we're trying to set up the server to allow for an SSH tunnel via SOCKS proxy to port 443, which is nearly always left open. (We have no plans on running web services over that port on this box.)

Research indicates this should be a two-step process: 1) edit /Library/Server/Web/Config/Proxy/apache_serviceproxy.conf to remove web listeners on ports 80 and 443; 2) edit /etc/ssh/ssh_config to add an SSH listener on port 443; then reboot.

Upon doing so, HTTP services indeed are turned off on 80 and 443, but I can't connect to SSH on port 443. Works fine over 22 still. Nmapping the server indicates that there's nothing open on port 443. Is there something else I need to do to open this up?

Answer 1

Here are steps to get SSH listening on port 443. Note that if you have SIP disabled, you can directly edit (as root) /System/Library/LaunchDaemons/ssh.plist and therefore can skip steps 1 and 3, and use the above path in steps 2 and 5. Note in that case you will want to run the unload command before editing ssh.plist.

1. Copy the existing ssh.plist file into /Library:

   sudo cp /System/Library/LaunchDaemons/ssh.plist /Library/LaunchDaemons/ssh2.plist
   

2. Edit the file as root:

   sudo nano /Library/LaunchDaemons/ssh2.plist
   

3. There are two things that need to be changed. First is the <Label>. Change this:

   <key>Label</key>
   <string>com.openssh.sshd</string>
   

   To something like this:

   <key>Label</key>
   <string>com.openssh.sshd443</string>
   

4. Next change this:

                   <key>SockServiceName</key>
                   <string>ssh</string>
   

   To this:

                   <key>SockServiceName</key>
                   <string>443</string>
   

5. Save and then run this command to load the service:

   sudo launchctl load -w /Library/LaunchDaemons/ssh2.plist
   

   If you ever need to unload it, you can do so with:

   sudo launchctl unload /Library/LaunchDaemons/ssh2.plist