Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Looking for help with a VPS config. I am a web developer that is trying to configure a 64 bit Ubuntu VPS. I changed the SSH port to 30000, added a user with all privileges and have set up the IPtables using the following script

*filter

#  Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -i ! lo -d 127.0.0.0/8 -j REJECT

#  Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allows all outbound traffic
#  You could modify this to only allow certain traffic
#  This is in addition to allowing established and related traffic as listed above
-A OUTPUT -j ACCEPT


# Allows HTTP and HTTPS connections from anywhere (the normal ports for websites)
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT


#  Allows SSH connections from trusted-host only - drop the rest
#
# CHANGE THE TRUSTED-HOST DETAILS AFTER THE WORD --source
# THE -dport NUMBER IS THE SAME ONE YOU SET UP IN THE SSHD_CONFIG FILE
#
-A INPUT -p tcp -m state --state NEW --source mydomain.com --dport 30000 -j ACCEPT
-A INPUT -p tcp --dport 30000 -j DROP

# Create time lock for non-wanted SSH attempts of a period of 1 minute
-A INPUT -p tcp -m state --syn --state NEW --dport 30000 -m limit --limit 1/minute       --limit-burst 1 -j ACCEPT
-A INPUT -p tcp -m state --syn --state NEW --dport 30000 -j DROP


# Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT


# log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7


# Reject all other inbound - default deny unless explicitly allowed policy
-A INPUT -j REJECT
-A FORWARD -j REJECT

COMMIT

When I try to SSH using the standard ssh command I get a connection refused error which is to be expected but when I try this command, the terminal seems to hang and becomes unresponsive and no connection is made.

ssh -p 30000 user@ipaddress

Am I doing something blatantly obvious with the ssh command or is there an error with the iptables script?

All help is very much appreciated!

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Check that the IP address that mydomain.com resolves to, is the same IP address that you are actually trying to connect from. I can make the same thing as you see happen, if I create the situation by connecting from a machine with the wrong IP address.

This line in particular

-A INPUT -p tcp --dport 30000 -j DROP

causes the terminal to appear to hang when connecting from the wrong machine. Removing the line and connecting from the wrong machine gives me the error message

ssh: connect to host host.lan port 22: No route to host

Throughout all of this I am able to connect if using a machine that has the correct IP address as resolved by mydomain.com.

share|improve this answer

I'm terrible with iptables, but what I will say is that running ssh on a non-standard port is basically futile. You can't assume people won't find the port - so you have to build in all the usual protection anyway (restricting access to specific users, or specific client machines, turning off password access and allowing key based access only, etc.)

In which case, the change of port is just more hassle than it's worth.

What I would suggest even if you want to move it to a different port, is get it working on the normal port using the normal config first, and then you can change the port knowing that it used to work, so only the port change can be the cause of any issues.

share|improve this answer
    
Exactly. Denying root password authentication, using pam_passwdqc to enforce secure passwords and using iptables limit to limit number of connections to SSH to under few a minute from single IP will give you much more secure setup. Security by obscurity doesn't work. –  Hubert Kario Aug 21 '11 at 16:39
1  
Add in denyhosts or fail2ban and you can reduce the amount of crap in auth.log / secure.log to a manageable level. Put sshd on port 30000 and a 5 second nmap will find it - granted, most scripts won't bother nmapping for it - but then those scripts won't get past any half decent security either, anyone who does run nmap is more likely to be willing to put the effort in, so you have to defend against them. –  EightBitTony Aug 21 '11 at 16:44
    
remember to white-list IPs you use (or can easily use) when using fail2ban –  Hubert Kario Aug 21 '11 at 16:47
    
While I agree with both of you about security through obscurity, I think there's another benefit to changing port numbers (Hubert's limit suggestion is on this same vein): reducing unsolicited connection attempts. For about 10 years I've been running ssh on an ancient 166MHz server on a DSL connection and for the first 5 years ssh was running on port 22. The server (and my DSL bandwidth) was noticeably impacted by the malicious automated scripts attempting to guess usernames & passwords. 5 years ago, I moved ssh to another port and there's no sign of the password-guessing script attacks. –  Klox Aug 21 '11 at 16:50
    
Fail2Ban and DenyHosts both deal with that by allowing you to block connections from IP addresses after X failed attempts. –  EightBitTony Aug 21 '11 at 17:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.