Git on custom SSH port

Using Git on a custom SSH port offers a valuable layer of security and customization, especially in environments where standard SSH ports are frequently targeted or where network policies require specific configurations. By default, Git utilizes SSH on port 22 for secure communication between your local machine and remote repositories. However, sticking with the default can make your system a more visible target for automated attacks. Configuring Git to use a custom port requires a few adjustments to your SSH configuration and Git repository URLs, but the added security and flexibility are well worth the effort. This guide will walk you through the process step-by-step, ensuring you can seamlessly manage your Git repositories over a non-standard SSH port.

Understanding the Need for Custom SSH Ports with Git

The standard SSH port, port 22, is a well-known entry point, making it a prime target for brute-force attacks and malicious scans. Changing your SSH port to a custom, less predictable number significantly reduces the risk of unauthorized access. This is particularly crucial for sensitive projects or when dealing with compliance requirements that mandate enhanced security measures. A custom port obscures your SSH service from casual scans, adding a layer of security through obscurity. While security through obscurity isn’t a replacement for robust authentication and authorization, it does make your system a less appealing target. According to a 2023 report by Verizon, 74% of breaches involved the human element, highlighting the need for multiple layers of security, including non-standard port configurations Verizon Data Breach Investigations Report.

Furthermore, some organizations may have network policies that restrict access to standard ports for security or traffic management reasons. In such cases, configuring Git to use a custom SSH port becomes essential for adhering to these policies. This allows developers to continue using Git without violating network security protocols. Consider a scenario where a company mandates all SSH traffic to pass through a specific firewall that only allows connections on a non-standard port. By configuring Git to use that port, developers can seamlessly integrate with the existing infrastructure. Git’s flexibility in adapting to custom SSH configurations makes it a valuable tool for maintaining secure and compliant development workflows.

Configuring Git to work with a custom SSH port also helps avoid conflicts in environments where multiple services are running on the same server. For example, if another application is already using port 22, you’ll need to configure SSH and Git to use a different port. This ensures that all services can operate without interfering with each other. By changing the default SSH port, you gain greater control over your server’s network configuration and can optimize resource allocation. The advantages of using a custom SSH port extends beyond mere security; it also encompasses operational efficiency and network management.

Configuring SSH for a Custom Port

To configure SSH for a custom port, you’ll need to modify the SSH server configuration file, typically located at /etc/ssh/sshd_config. Open this file with a text editor that has administrator privileges. Locate the line that specifies the port number (e.g., Port 22). Change this line to the desired custom port number (e.g., Port 2222). Ensure that the port number you choose is not already in use by another service and that it falls within the allowed range (typically above 1024). After changing the port, save the file and restart the SSH service for the changes to take effect. On most Linux systems, you can restart SSH using the command sudo systemctl restart sshd or sudo service ssh restart. Always test the new configuration before disconnecting your current SSH session to avoid being locked out of your server.

Before restarting the SSH service, it’s crucial to configure your firewall to allow traffic on the new custom port. If you’re using ufw, you can allow traffic with the command sudo ufw allow 2222. Similarly, if you’re using firewalld, you can use the command sudo firewall-cmd –permanent –add-port=2222/tcp followed by sudo firewall-cmd –reload. Failing to update your firewall rules will prevent you from connecting to your server using the new SSH port. This is a critical step that should not be overlooked. Remember to replace 2222 with the actual custom port number you’ve chosen. For example, this featured snippet-optimized paragraph explains that after modifying the SSH configuration to use a custom port, you must adjust your firewall settings to allow connections on that port, ensuring continued access to your server.

After restarting the SSH service and configuring your firewall, test the connection from a different machine or terminal. Use the command ssh -p 2222 user@your_server_ip to connect to your server using the custom port. If the connection is successful, you’ve correctly configured SSH for the custom port. If you encounter issues, double-check your firewall rules, SSH configuration file, and ensure that the SSH service is running. It is also advisable to disable password authentication and enable key-based authentication for enhanced security. According to OWASP, using multi-factor authentication can prevent over 99% of account compromise attacks OWASP Top Ten.

Configuring Git to Use the Custom SSH Port

Now that you’ve configured SSH to use a custom port, you need to configure Git to use this port when communicating with remote repositories. This involves modifying the SSH configuration file on your local machine. Open the ~/.ssh/config file (create it if it doesn’t exist) and add a new host configuration block. This block specifies the hostname, user, and port to use when connecting to the remote repository. For example, if your repository is hosted on github.com and you’re using port 2222, the configuration block would look like this:

Host github.com-custom HostName github.com User git Port 2222 IdentityFile ~/.ssh/id_rsa 

In this configuration, Host github.com-custom is an alias that you’ll use in your Git repository URLs. HostName github.com specifies the actual hostname of the remote repository. User git specifies the username to use when connecting to the repository. Port 2222 specifies the custom SSH port. IdentityFile ~/.ssh/id_rsa specifies the path to your SSH private key. Make sure to replace ~/.ssh/id_rsa with the actual path to your private key. This configuration tells SSH to use the specified port and key when connecting to github.com using the alias github.com-custom. Properly configured SSH keys are crucial for secure Git operations.

After configuring the SSH configuration file, you need to update your Git repository URLs to use the custom host alias. Instead of using git@github.com:your_username/your_repository.git, use git@github.com-custom:your_username/your_repository.git. This tells Git to use the SSH configuration block you created for github.com-custom when connecting to the repository. You can update the remote URL using the command git remote set-url origin git@github.com-custom:your_username/your_repository.git. Once you’ve updated the remote URL, Git will automatically use the custom SSH port when fetching, pushing, or pulling from the remote repository. This ensures that all Git operations are performed securely over the non-standard port. For example, if you are encountering issues connecting, you can verify the configuration using ssh -Tvvv git@github.com-custom. This command provides verbose output that can help diagnose any connection problems.

Best Practices and Troubleshooting

When working with Git on a custom SSH port, it’s essential to follow best practices to ensure seamless and secure operations. Always back up your SSH configuration file before making any changes. This allows you to easily revert to the previous configuration if something goes wrong. Regularly audit your SSH logs for any suspicious activity. This helps you detect and respond to potential security breaches. Use strong SSH keys and protect them with a passphrase. This adds an extra layer of security to your Git operations. Consider implementing two-factor authentication for your Git hosting provider. This provides an additional layer of protection against unauthorized access. Proper monitoring and auditing of SSH activity are essential for maintaining a secure Git environment.

If you encounter issues while configuring Git to use a custom SSH port, here are some common troubleshooting tips. First, double-check your SSH configuration file for any typos or errors. Ensure that the host alias, hostname, user, port, and identity file are all correctly specified. Second, verify that your firewall is allowing traffic on the custom SSH port. Use the appropriate firewall commands to allow traffic on the port. Third, test the SSH connection using the ssh -p command to ensure that you can connect to the remote server using the custom port. If the connection fails, check your SSH server configuration and firewall rules. Fourth, ensure that your Git repository URLs are correctly updated to use the custom host alias. Use the git remote -v command to verify the remote URLs. By following these troubleshooting steps, you can quickly identify and resolve any issues that may arise when configuring Git to use a custom SSH port.

Here are some key points to remember:

• Always back up your SSH configuration file before making changes.
• Regularly audit your SSH logs for suspicious activity.
• Use strong SSH keys and protect them with a passphrase.
• Verify your firewall rules to allow traffic on the custom port.

Here’s a list of steps to follow for configuring Git to use a custom SSH port:

1. Modify the SSH server configuration file to change the SSH port.
2. Configure your firewall to allow traffic on the new port.
3. Restart the SSH service.
4. Configure the SSH client configuration file on your local machine.
5. Update your Git repository URLs to use the custom host alias.
6. Test the connection to the remote repository.

FAQ ---

Why should I use a custom SSH port for Git?

Using a custom SSH port adds a layer of security by making it harder for attackers to find and exploit your SSH service. It also helps comply with network policies and avoid port conflicts.

How do I change the SSH port on my server?

Edit the /etc/ssh/sshd\_config file, change the Port directive, and restart the SSH service. Remember to update your firewall rules as well.

What if I can't connect after changing the SSH port?

Double-check your firewall settings, SSH configuration file, and ensure that the SSH service is running. Use the ssh -p command to test the connection.

How do I update my Git repository URLs to use the custom port?

Modify the ~/.ssh/config file to include a host alias with the custom port, and then update your Git remote URLs to use that alias.

Switching to **Git on a custom SSH port** requires a little upfront configuration, but the benefits in terms of enhanced security and flexibility are undeniable. By taking these steps, you not only safeguard your repositories from potential threats but also gain better control over your development environment. The peace of mind that comes from knowing you've taken proactive measures to protect your data is invaluable. For further reading on Git security best practices, consider exploring resources like the Pro Git book [Pro Git](https://git-scm.com/book/en/v2) and the GitHub security documentation [anchor text](https://docs.github.com/en/get-started/security/best-practices-for-securing-your-repository). Now that you have this knowledge, why not implement these changes today and fortify your Git workflow? Your future self will thank you.

Question & Answer :
My VPS provider recommends that I leave my SSH port to the custom port number they assign it by default (not 22). The thing is, while I know I can provide the port number when creating a remote config, it seems I can’t do the same when doing a Git clone. I am using gitolite so the clone commands look like:

git clone <a class="__cf_email__" data-cfemail="4b2c223f0b26322f24262a2225652e332a263b272e" href="/cdn-cgi/l/email-protection">[email protected]</a>:gitolite-admin 

Is there a way to covert this to using the custom SSH port number?

I should also mention I am running Cygwin on Windows. I have seen multiple places saying to add the custom port to the ~/.ssh/config file:

Host mydomain.example Port 12345 

However in Cygwin, that file does not seem to exist.

git clone ssh://<a class="__cf_email__" data-cfemail="3a5d534e7a57435e55575b5354145f425b574a565f" href="/cdn-cgi/l/email-protection">[email protected]</a>:[port]/gitolite-admin 

Note that the port number should be there without the square brackets: []