I now have changed the ssh config file (change port 22 to 777) and told firewall-cmd the following firewall-cmd --add-port=777/tcp --permanent
Then restarted the service (required to take the changes into effect).
It works, but still the firewall ssh service lists 22 as an open port and the firewall-cmd --list-ports show 777 as an open port.
Now it would be more elegant if I could change the ssh service port and not add addiotnal ports.
How to do this please AND are there consequences ?
# Make sshd listen on :22 and :2222
printf "Port 22\nPort 2222\n" > /etc/ssh/sshd_config.d/10-ports.conf
# Authorize sshd to listen port 2222
semanage port -a -t ssh_port_t -p tcp 2222
# Change Firewalld SSH service configuration to use port 2222
firewall-cmd --permanent --service=ssh --add-port=2222/tcp
firewall-cmd --permanent --service=ssh --remove-port=22/tcp
# Restart service and apply new firewall configuration
systemctl restart sshd
firewall-cmd --reload
Some commands to check the above configuration status
# Print Firewalld configuration for SSH service
firewall-cmd --info-service=ssh
# Print locally customized SELinux ports
semanage port -l -C
Full node firewall status is available also from the Nodes page
And I don’t think Crowdsec should be the only answer for “increase host security” (which might be uncorrect as term for indicating the master node); not everyone will consider to install public-facing application servers.
It’s fine not considering this a viable feature, however… consider the effort to realize a “NS8 friendly” procedure for all suggested/supported underlying distros.
@davidep
Obscuring or not, i just can confirm from many years of running sshd on ns7 on a non standard port, it is minimizing login attempts by a factor 10 when using a non standard port under 1024 and by a factor 25 when using a non standard port above 1024.
I would say it is a no-brainer to change the sshd port to a (large) non standard port.
Fail2ban will take care of all those other attempts
See the new procedure in the next comment 
?