How to change the default sshd port on Mac OS X — 09 Oct 2012

I’ve been subjected to an interrupted stream of failed login attempts on port 22 (sshd) this last week that are clogging up my log files.

Turning off sshd (a.k.a. Remote Login) altogether was a half backed option as I connect remotely to my workstation, so I decided to change the default sshd port to wave off the bulk of repeated login attempts.

Editing the ssh.plist preference file

1. Turn off Remote login in the Sharing Preference pane
2. Open the Terminal (/Applications/Utilities/Terminal)
3. Navigate to /System/Library/LaunchDaemons/
4. Make a backup copy of ssh.plist
5. Edit ssh.plist and replace the service name (ssh) with the port you wish to use (e.g. 22091)
6. Save the changes and turn Remote login back on in the Sharing Preference pane (which restarts the ssh service with launchctl)
7. Test your connection in the Terminal ssh yourusername@yourdomain.com -p 22091 (use the port number you chose).

The following 2 occurences were changed:

[…]
<key>Sockets</key>
<dict>
    <key>Listeners</key>
    <dict>
        <key>SockServiceName</key>
        <string>22091</string>
        <key>Bonjour</key>
        <array>
            <string>22091</string>
            <string>sftp-ssh</string>
        </array>
    </dict>
</dict>
[…]

You can find more information on launchd handled services on Mac OS X in the launchd.plist(5) manual.