10

TL:DR

I made changes to my iptables config and now SSH is refusing all connections. Can I fix this without contacting my hosting company?


Long Version

Ok, this is most likely 100% my own fault...

In preparation of moving a website to a dedicated server, we got a new hosted machine running CentOS 5.6. The machine has iptables pretty locked down, only allowing ssh(22) and http(80) but we also needed it to accept FTP over port 20 en 21.

This afternoon I added to lines to my iptables in order to accept incoming connection to ports 20 and 21. At first that didn't work because there was a reject allline above the lines I added for ftp. So I moved that line down to the bottom, saved and restarted iptables and ftp was working.

2 hours later, when I try to connect again, port 22: Connection refused Same for http.

So I can't get to the server through SSH, is there any way I can fix this without contacting my hosting company?

13

Unfortunately, no. Not unless you have some other management interface available like a remote serial console, iDRAC, iLO, etc. Chalk it up to experience and remember to test settings before you log out next time ;)

| improve this answer | |
  • 12
    Or if you experiment with iptables make sure that you temporarily set a cron job that resets the ruleset every 15 minutes. – mailq Aug 12 '11 at 19:10
  • 1
    Lesson learned :) – Jan Henckens Aug 12 '11 at 19:24
  • How would you enable the SSH port 22 using iDRAC? – terrid25 Aug 31 '11 at 13:39
  • @terrid25 you would login using the serial console listening on the serial port that iDRAC gives you access to. you can then fix iptables and be on your merry way. of course, if your out-of-band stuff isn't set up with remote console and such you'll be just as stuck as your friend with no remote management at all. – Michael Lowman Sep 1 '11 at 3:28
7

Assuming you can still ftp to the server, and you can log in as root via ftp (unlikely and ordinarily ill-advised) into a non-chrooted (etc) environment:

Put a file in /etc/cron.d with these contents:

* * * * * root /sbin/service iptables stop 
| improve this answer | |
  • This helped me, because I can remotely connect a recovery image and access the filesystem. – Daniel W. Jun 7 '15 at 11:57
0

As per these instructions, you can also append:

scripts2/doautofixer?autofix=iptablesflush

... to your WHM url. I did that and ended up with a URL:

https://mysite:2087/SESSION_ID/scripts2/doautofixer?autofix=iptablesflush

It reset my iptables and everything was good with the world again. :)

| improve this answer | |
0

In CentOS you have the file /etc/sysconfig/iptables if you don't have it there, you can create it simply by using iptables-save to dump the current rule set into a file.

iptables-save > /etc/sysconfig/iptables

To load the file you don't need to restart the machine, you can use iptables-restore

iptables-restore < /etc/sysconfig/iptables
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.