Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

TL:DR

I made changes to my iptables config and now SSH is refusing all connections. Can I fix this without contacting my hosting company?


Long Version

Ok, this is most likely 100% my own fault...

In preparation of moving a website to a dedicated server, we got a new hosted machine running CentOS 5.6. The machine has iptables pretty locked down, only allowing ssh(22) and http(80) but we also needed it to accept FTP over port 20 en 21.

This afternoon I added to lines to my iptables in order to accept incoming connection to ports 20 and 21. At first that didn't work because there was a reject allline above the lines I added for ftp. So I moved that line down to the bottom, saved and restarted iptables and ftp was working.

2 hours later, when I try to connect again, port 22: Connection refused Same for http.

So I can't get to the server through SSH, is there any way I can fix this without contacting my hosting company?

share|improve this question
add comment

2 Answers

up vote 10 down vote accepted

Unfortunately, no. Not unless you have some other management interface available like a remote serial console, iDRAC, iLO, etc. Chalk it up to experience and remember to test settings before you log out next time ;)

share|improve this answer
4  
Or if you experiment with iptables make sure that you temporarily set a cron job that resets the ruleset every 15 minutes. –  mailq Aug 12 '11 at 19:10
    
Lesson learned :) –  Jannemans Aug 12 '11 at 19:24
    
How would you enable the SSH port 22 using iDRAC? –  terrid25 Aug 31 '11 at 13:39
    
@terrid25 you would login using the serial console listening on the serial port that iDRAC gives you access to. you can then fix iptables and be on your merry way. of course, if your out-of-band stuff isn't set up with remote console and such you'll be just as stuck as your friend with no remote management at all. –  Michael Lowman Sep 1 '11 at 3:28
add comment

Assuming you can still ftp to the server, and you can log in as root via ftp (unlikely and ordinarily ill-advised) into a non-chrooted (etc) environment:

Put a file in /etc/cron.d with these contents:

* * * * * root /sbin/service iptables stop 
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.