TL;DR heinzel has no notion of an SSH port other than 22, so such hosts depend on the workstation's ~/.ssh/config, and the firewall rules can lock heinzel out of them.
Where: rules/ssh-user.md and rules/server-memory.md (what heinzel stores per host), rules/first-connection.md step 4, the firewall sections of rules/debian.md, rhel.md, suse.md, freebsd.md.
Now: heinzel stores the SSH user per host, but no port. A host on 2222 works only if ~/.ssh/config carries the port, which is often not maintained per host and is not shared with a team. Before enabling a firewall, the rules add ufw allow OpenSSH or firewalld's ssh service, which open 22 only.
Should: heinzel stores a port other than 22 per host, shared like the rest of server memory, and uses it on every call. On a new host it finds the port without guessing, and firewall changes keep open the ports sshd actually listens on.
Constraints: No port scanning and no list of "common" ports: connections that never log in count for fail2ban, sshd's PerSourcePenalties and IPS scan detection. ~/.ssh/config stays a valid source.
Part of #27.
An AI agent wrote this text in my name. I know that is problematic.
TL;DR heinzel has no notion of an SSH port other than 22, so such hosts depend on the workstation's
~/.ssh/config, and the firewall rules can lock heinzel out of them.Where:
rules/ssh-user.mdandrules/server-memory.md(what heinzel stores per host),rules/first-connection.mdstep 4, the firewall sections ofrules/debian.md,rhel.md,suse.md,freebsd.md.Now: heinzel stores the SSH user per host, but no port. A host on 2222 works only if
~/.ssh/configcarries the port, which is often not maintained per host and is not shared with a team. Before enabling a firewall, the rules addufw allow OpenSSHor firewalld'ssshservice, which open 22 only.Should: heinzel stores a port other than 22 per host, shared like the rest of server memory, and uses it on every call. On a new host it finds the port without guessing, and firewall changes keep open the ports sshd actually listens on.
Constraints: No port scanning and no list of "common" ports: connections that never log in count for fail2ban, sshd's
PerSourcePenaltiesand IPS scan detection.~/.ssh/configstays a valid source.Part of #27.
An AI agent wrote this text in my name. I know that is problematic.