Thread: SSH Related Questions - Pls Help

Hi Guys.

I want to restrict access to my SSH port on cpanel/whm to certain IP addresses or to block it, how do I do this?

Also, how do I change the SSH port from 22 to any other number on cpanel/whm

Kindly note that I have ConfigServer Security & Firewall installed on the cpanel

Thank you very much.

There's a few different options you could use to restrict SSH to certain IP space, such as for example Host Access Control: https://docs.cpanel.net/whm/security...ccess-control/

Another option is via CSF: https://forum.configserver.com/viewt...bfdbbe6c#p3471

To change the SSH port, see https://support.cpanel.net/hc/en-us/...e-the-SSH-port

https://support.cpanel.net/hc/en-us/...e-the-SSH-port

Kindly share details with me. It seems I am yet to get it right.

Originally Posted by ResellerFly

Kindly share details with me. It seems I am yet to get it right.

What did you do so far?

1: Use CSF
2: Remove the port from csf configs in WHM
3: Add your whitelisted IP's to CSF

You can't change the ssh port directly within WHM, however you can do so directly from SSH

just go to /etc/sshd/sshd_config and change in there

If you have SSH access, can you not login through SSH, and edit the SSH configuration files?


You can also use iptables to whitelist IPs:

This command block will restrict port 80 and 443 to 202.181.177.177 IPv4 address, and will not accept connections from any other IPs.

iptables -N xxx # create a new chain named xxx

iptables -A xxx --src 202.181.177.177 -j ACCEPT

iptables -A xxx -j DROP # drop everyone else

iptables -I INPUT -m tcp -p tcp --dport 80 -j xxx
iptables -I INPUT -m tcp -p tcp --dport 443 -j xxx

Originally Posted by HammerVM LTD

If you have SSH access, can you not login through SSH, and edit the SSH configuration files?

Absolutely, although from the questions they've asked it seems they're not an experienced systems administrator and may not know how to actually do that. Everyone starts somewhere.

Originally Posted by HammerVM LTD

You can also use iptables to whitelist IPs:

This command block will restrict port 80 and 443 to 202.181.177.177 IPv4 address, and will not accept connections from any other IPs.

iptables -N xxx # create a new chain named xxx

iptables -A xxx --src 202.181.177.177 -j ACCEPT

iptables -A xxx -j DROP # drop everyone else

iptables -I INPUT -m tcp -p tcp --dport 80 -j xxx
iptables -I INPUT -m tcp -p tcp --dport 443 -j xxx

As they already have CSF installed, there's no reason to manually manage the IPTables rules for this.