How to open a non-default port for sftp?

Question

My MacMini at work used to listen on port 12345 for sFTP for close to 9 months but then something (probably a power cut...) messed all things Remote up with the office setup. So I tried to reset things. It didn't work. What do you think I'm doing wrong? The MacMini is running Tiger (10.4.10). Here's what I've done so far:
1. Drilled a hole for port 12345 on my Thomson (Alcatel SpeedTouch 780) modem/router, and disabled its Firewall and Parental Controls;
2. In System Prefs>Sharing>Firewall I have enabled the Firewall after making sure I've added a service for port 12345;
3. Also in System Prefs I've enabled Remote Login, to make sure the sftp daemon is running;
4. Back on the Thomson modem/router, I've set up a service to forward port 12345 of the router to port 12345 of my MacMini (I selected it by clicking on its MAC address in the appropriate drop down menu in the modem/router config page).
STILL: when I try to sftp to my MacMini from outside the office, I get a timeout error. Back at the MacMini, I run Network Utility and ask it to check at IP (the MacMini IP) for ports 12345 to 12345, and it doesn't report it as 'open' (it does for port 22).
I am bummed. What am I missing? I am also 100 miles away from the office on any given day, so it's not exactly easy to pop over and try various troubleshooting things. I have to kill this once and for all next I'm at the office, some time in the weekend!
As always, thanks, people.
< Edited by Host >

Answer 1

It sounds to me like the port forwarding is setup, so that's not the issue.
The issue is how to change sshd to listen on port 12345 rather than port 22. However, I'm not sure that you need to.
If you're trying to hide your server from the public, why not just setup your port forwarding to forward publicIP:12345 to privateIP:22.
That way you connect to port 12345 from your remote location, but don't have to change the server configuration at all.
The only reason why this wouldn't work would be if your router doesn't support different internal and external ports (e.g. it always maps to the same internal port number).
If that's the case then you need to change launchd to listen on port 12345. How you do that depends on whether you want to move the entire SSH service to port 12345, or whether you want SSH to support 22 and 12345 at the same time.
If the former, just edit /System/Library/LaunchDaemons/ssh.plist and change the lines:
<key>SockServiceName</key>
<string>ssh</string>
to:
<key>SockServiceName</key>
<string>italk</string>
(italk is the registered service for port 12345).
Then either reboot or unload/reload the ssh.plist to make the change active.
If you want ssh to run on both port 22 and 12345 then you should copy /System/Library/LaunchDaemons/ssh.plist to /Library/LaunchDaemons/ssh-12345.plist then make three changes to the new .plist file:
First, change the <Label> parameter to something unique (i.e. not 'com.openssh.sshd').
Second, remove the <Bonjour> array
Third, edit the SockServiceName as indicated above.
Once you've done that, reboot and you should be set.