SSH algorithms on alternate ports (outside view)
high external
What it inspects
Looks for this finding: SSH on an alternate port offers weak or deprecated algorithms to the internet. Tries TCP ports 2222, 22222, 2022, 822, 2200, 22022 and 2322 (common places to move SSH to; port 22 is covered by the SSH algorithms check) and, for every port that answers with an SSH banner, reads the algorithm lists the server announces in its key-exchange offer (KEXINIT), which is sent before any login. No credentials are sent. FAIL, naming the port, if any list contains SHA-1 key exchange, CBC/3DES/arcfour/Blowfish/CAST ciphers, MD5/SHA-1/UMAC-64 MACs, or ssh-rsa/ssh-dss host keys. PASS if nothing answers or every SSH port offers only modern algorithms. It cannot read the host's sshd configuration, so an SSH port outside this list is not seen. This is an active check: it runs only after you have verified ownership of the host; otherwise it is skipped.
Why it matters
Finding: SSH on an alternate port offers weak or deprecated algorithms to the internet. SSH moved to another port is still SSH: a server that offers a broken algorithm there lets a client or an attacker in the middle negotiate it, even if stronger ones are also listed. A second SSH port is often a leftover from a migration or a workaround and is easy to forget when hardening port 22.
How to verify
# only against hosts you own
nmap -Pn -p 2222,22222,2022,822,2200,22022,2322 --script ssh2-enum-algos example.com
# Ports reported closed or filtered are fine. For any open SSH port look for: *-sha1 key exchange, *-cbc / 3des / arcfour ciphers, hmac-md5 / hmac-sha1 / umac-64 MACs, ssh-rsa / ssh-dss host keys.
How to fix
Clears the finding "SSH on an alternate port offers weak or deprecated algorithms to the internet". Apply the same algorithm restrictions to every port sshd listens on, or remove the extra SSH port and close it at the firewall.
Harden every SSH port, or remove the extra one needs your judgement
Any distro
# This check found SSH answering on a port other than 22 and that SSH offers weak algorithms. sshd applies KexAlgorithms, Ciphers, MACs
# and HostKeyAlgorithms to EVERY port it listens on, so the fix is the same one as for port 22: the "Remove weak algorithms from the SSH
# offer" step of the external_ssh_weak_algorithms check (a validated drop-in on Debian/Ubuntu, an SSH-scoped crypto-policy module on the
# RHEL family). Run it once; it covers every port.
#
# Find out which ports sshd really listens on (the effective configuration, including drop-ins):
# sshd -T | grep -i '^port '
# ss -tlnp | grep sshd
# On Ubuntu 23.10+ (including 24.04 LTS) that starts sshd from ssh.socket, the sshd-socket-generator reads Port/ListenAddress from
# sshd_config and writes the ListenStream drop-in at daemon-reload, so the Port line is what you edit. Only Ubuntu 22.10 and 23.04 have
# no generator and need a ListenStream edit via `systemctl edit ssh.socket`. See what the socket is doing:
# systemctl cat ssh.socket
# systemctl list-sockets | grep -i ssh
# If a second SSH port is not needed, remove it rather than hardening it: delete its Port line (on 23.10+ do NOT add a ListenStream
# override instead; the generator would keep re-creating the port). Validate first, then apply the way your host actually runs sshd. Never restart ssh.socket unless it is active:
# on a host where sshd runs as a plain service, restarting the socket turns on socket activation (default port 22) and can fight the
# running sshd for the port you kept.
# if systemctl is-active --quiet ssh.socket; then sshd -t && systemctl daemon-reload && systemctl restart ssh.socket; fi
# Otherwise (ssh.socket not active): sshd -t && systemctl reload ssh (the unit is sshd on the RHEL family)
# Then close the removed port at the firewall. Keep your current session open and test a fresh login from a second session before closing it.