8

When you are configuring iptables or SSH over SSH and the data center is thousands of kilometers away (and getting someone there to plug in a KVM is hard), what are some standard practices to prevent locking yourself out?

2
  • 4
    Get a real server with built-in KVM over IP. Problem solved (I admit: If you get the d&*^%&2 java plugin to run, that is).
    – Sven
    May 30, 2014 at 8:58
  • 2
    @SvW +1 for @%&#$@%#$%!^ Java. The bane of my existence are java based IPMI solutions (and printers, yuck HP) with a obsolete Java version, that doesn't play nice with newer Java and enhanced Java security.
    – Tonny
    May 30, 2014 at 9:35

3 Answers 3

18

There was a similar question Configure iptables over SSH without getting locked out?

I post here the tips I gave in the previous question:

1) I backup the old iptables configuration file:

cp /etc/sysconfig/iptables /etc/sysconfig/iptables.bak

2) Before trying the new settings, execute this command to make sure you can connect back if something in the new settings locks you out (basically it replaces the old rules after 5 minutes):

echo "mv /etc/sysconfig/iptables.bak /etc/sysconfig/iptables && service iptables restart" | at now + 5min

3) Now you can safely modify iptables rules. If something goes bad you can connect back within 5 minutes.

4
  • 5
    I tend to use at now+5min service iptables stop ^D, but the effect is the same. Once I know I've not locked myself out, I can use atrm to remove the job.
    – MadHatter
    May 30, 2014 at 9:05
  • What is with those large time frames? I use 60s, try to open a new shell and if that works, immediately deem it a success. Is that too optimistic? 15min seems like way too long.
    – musiKk
    Jun 2, 2014 at 14:37
  • 15 min seems a long time frame but you can always change it. It depends on what you need to do. In that case I just needed some time to check some firewall rules and 15 minutes was a reasonable time to conduct for my tests. Anyway, I updated the post with 5 min.
    – shardan
    Jun 2, 2014 at 20:41
  • 1
    you will need to yum install at, and systemctl start atd to use it, or else it will fail. dont forget to systemtemctl enable atd if you want it on reboot. Nov 7, 2019 at 21:22
1

If you need to modify the SSH config, e.g in /etc/ssh/sshd_config: Leave a session open in another terminal. This usually will stay open, but of course you can use a similar trick as in @shardan's post for the SSH config as well.

5
  • Not if you need to restart ssh to update the config...
    – user36976
    May 30, 2014 at 9:02
  • @Nick: No, that's not true, the connection usually stays open.
    – Sven
    May 30, 2014 at 9:04
  • That is probably true in firewalls with a generic -A INPUT -m state ESTABLISHED -j ACCEPT, as you're unlikely to touch that line and it tends to come early in the ruleset - but for firewalls which are more selective about accepting INPUT traffic, in my experience it's very possible to shut yourself out of an existing ssh connection.
    – MadHatter
    May 30, 2014 at 9:07
  • @MadHatter: I am talking about editing /etc/ssh/sshd_config and the need to restart the SSH daemon.
    – Sven
    May 30, 2014 at 9:09
  • Sorry, SvW, I had missed that; I agree with your point.
    – MadHatter
    May 30, 2014 at 9:17
0

Another way to ensure you have access is to use the -R flag of ssh on the remote server:

/usr/bin/ssh -R 55555:localhost:22 [email protected]

From your.otherserver.com you can now log into the remote machine using:

ssh localhost -p 55555

To ensure that I'm not locked out for more than 5 mins I run a cron job that runs the following shell script on the remote server:

#! /bin/sh 
GREPSSH=$(ps ax|grep serverkey|awk -F ' ' '{print $1}')
if [ "$GREPSSH" -eq NULL ]
then
echo "no sshlink \n"
/usr/bin/ssh -nNT -i ~/.ssh/serverkey -R 55555:localhost:22 -o ServerAliveInterval=60 -o ExitOnForwardFailure=yes [email protected] &
else echo $GREPSSH
exit 1
fi

This script:

  • checks the if the outbound ssh is running
  • if not it starts it with various options (-nNT and -o) and the -R for port forwarding to the remote server
  • uses a ssh identity key (-i) to allow login without a password to your.otherserver.com

I have found this is a useful tool for getting back into remote machines :~)

Not the answer you're looking for? Browse other questions tagged .