Alexis Kestler
As a cloud computing enthusiast and Google Cloud Platform (GCP) user, one of my top frequently asked questions is: how do I connect to a GCP virtual machine instance on a non-standard SSH port?
While the default SSH port 22 works fine, many security-conscious users like to change it to something more obscure like 2222, especially for internet-facing VMs. As a pro tip for my fellow tech geeks out there, let me walk you through the various methods to access your GCP VMs on custom ports.
Why Use a Non-Standard SSH Port?
Before we dive into the how-to, let‘s briefly go over the rationale behind changing the default SSH port in the first place. Here are some key benefits:
-
Reduced Botnet Scans: Hackers often perform wide internet scans probing for port 22. Moving to a non-standard port helps avoid some of these automated botnet attacks.
-
Extra Layer of Security: While not a security silver bullet, using an obscure port makes it a bit harder for attackers to find your SSH service. It‘s one extra step in a defense-in-depth approach.
-
Avoiding Conflicts: If you need to run multiple SSH servers on a single IP, using different ports allows them to co-exist.
However, there are also downsides to consider:
-
Compatibility Issues: Some older SSH programs don‘t support port flag options and may not work.
-
False Sense of Security: Obscurity alone is not enough – you still need proper authentication, firewall rules, etc.
Overall, changing the SSH port makes sense as part of a comprehensive security plan. But don‘t rely on it as your only protection. Now let‘s look at how to actually connect through a custom port on GCP.
Connecting via gcloud CLI
The gcloud compute ssh command provides the easiest way to connect to GCP VMs. To use a non-standard port, specify the --ssh-flag parameter:
gcloud compute ssh --zone "us-central1-a" "my-vm" --ssh-flag="-p 2222"Where:
--zone= your VM‘s zone"my-vm"= your VM name-p 2222= port number
You can grab the base gcloud ssh command from the GCP Console by clicking the SSH dropdown next to your VM and choosing "View gcloud command". Then just append the port flag.
Pro Tip: Add the --ssh-flag option to your ~/.ssh/config file to save typing it on every login!
Connecting via Web-based SSH
If you prefer clicking over typing, GCP provides a simple web-based SSH client accessible from the VM instances page.
Just click the SSH dropdown next to your VM, choose "Open in a browser window on a custom port", enter your custom SSH port and click Open. This will launch the SSH session right in your browser without any client required.
Connecting from a Local SSH Client
You can also connect from SSH clients like OpenSSH and PuTTY on your own computer. Just specify the port using the -p flag:
ssh -p 2222 username@vm-ip-addressWhere username is your account name on the VM and vm-ip-address is the VM‘s internal or external IP.
Note: Some older SSH clients may not support the -p flag. In that case, you can instead modify the SSH configuration file with the custom port.
Key Security Considerations
While using an obscure port has advantages, it does not replace proper security measures. Here are some other best practices to follow:
- Use SSH public-key authentication instead of passwords
- Enable OS Login to provide certificate-based access
- Restrict VM access to only trusted IP address ranges
- Configure the VPC firewall to only allow required ports
- Use Cloud IAP for completely portless VM access
Obscuring the SSH port should be one layer in your defense-in-depth strategy. Combined with other controls, it can enhance your overall security posture.
Closing Thoughts
I hope this detailed walkthrough gave you some new insights on connecting to your GCP VMs on non-standard SSH ports, whether via gcloud, web SSH or a local client.
While not a cure-all, using obscure ports can help reduce automated attacks and improve your cloud security – provided you also implement strong authentication, firewalls, and other best practices.
Let me know if you have any other tips or questions! I‘m always happy to help fellow cloud geeks strengthen their Google Cloud security.
