Remember a non-standard SSH port per server [15m] - #15
jpawlowski wants to merge 5 commits into
Conversation
heinzel stored the SSH user per host but no port, so a host on 2222 only worked if ~/.ssh/config carried the port, and that file is often not maintained per host. The port is a fact of the host, so it goes into server memory as "- SSH port:", shared in team mode, and every call adds -o Port=, which ssh, scp, sftp and rsync -e all accept. On first contact heinzel first asks known_hosts, without a connection, whether the user accepted the host key earlier on another port. If port 22 refuses, it tries the user's own "Alternative SSH ports:" from memory/user.md, once each and at most three, then asks and offers to add the answer to that list. There is no built-in list of common ports: several ports in a row look like a scan to IPS rules, and a timeout on 22 never leads to trying others. Alias detection now needs the same address and port, since one NATed address can reach several hosts. The firewall rules point out that "ufw allow OpenSSH" and firewalld's ssh service open 22 only, and name the port sshd listens on as the one to keep open. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The choices behind this, in case one of them looks odd: Port in server memory, user name in
No list of "common" ports. Beyond 2222 there is no real consensus, and trying five ports in a row on one host looks like a port scan to psad, portsentry and provider IPS. Only ports the user runs sshd on themselves are tried, once each, at most three. Only on A login, not just an answer. A 2222 in the picker, not in the probe. It is offered as a choice when heinzel asks, never tried unasked. Firewall. An AI agent wrote this text in my name. I know that is problematic. |
The fleet audit names the port where the SSH call is built (step 3), and the README gets its own short section instead of editing the shared list of memory files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The firewall recipes allowed OpenSSH or firewalld's ssh service, which open port 22 only, so enabling a firewall on a host whose sshd listens elsewhere locked heinzel out. CLAUDE.md now has the agent read the ports from sshd -T, ListenAddress included, before enabling or tightening a firewall, and the family files point there instead of repeating the probe. Remembering a port per server (#15) is a separate feature and stays out of this change. An AI agent wrote this text in my name. I know that is problematic.
# Conflicts: # .claude/skills/heinzel-fleet-audit/references/probes.md
Alias detection now resolves a name through ssh -G, so a host whose port comes from ~/.ssh/config has no "- SSH port:" line and compared as 22. The port of either side is the named one, else the memory line, else the port ssh -G prints. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…at/remember-ssh-port # Conflicts: # CLAUDE.md # rules/debian.md # rules/rhel.md # rules/suse.md
1 participant
Gap: heinzel stored the SSH user per host but no port. A host on another port worked only if
~/.ssh/configcarried it, and the firewall rules (ufw allow OpenSSH, firewalld'ssshservice) open 22 only.Change: New
rules/ssh-port.md. A port other than 22 goes into server memory as- SSH port:, and every call adds-o Port=. On first contact, when 22 refuses, heinzel checksknown_hosts, tries the user's ownAlternative SSH ports:frommemory/user.md, then asks. No built-in port list, no scanning. Alias detection also compares the port; firewall changes keep every port sshd listens on open.Size: Rules only. No merge order; shared files follow #27, and I take in
mainafter each merge.Verified: guard test matrix 549 passed, 0 failed.
ssh-keygen -F '[host]:port'checked against a hashedknown_hostsfile (OpenSSH 10.3).Part of #27.
Closes #32.
An AI agent wrote this text in my name. I know that is problematic.