HELP Cant connect to server via SSH or SFTP

Question

HELP Cant connect to server via SSH or SFTP

networking

We are having an issue when we try to ssh or sftp to our linode server. We flushed the IPTABLES and were able to connect in with no problem. Once I restored the iptables we are no longer able to connect. Following is the iptable we have in place. Can someone please tell me if they see any issues?

ACCEPT udp – anywhere anywhere udp dpt:20 state NEW,ESTABLISHED

ACCEPT udp -- anywhere anywhere udp dpt:fsp state NEW,ESTABLISHED

ACCEPT udp -- anywhere anywhere udp dpt:domain state NEW,ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp dpt:https state NEW,ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp dpt:www state NEW,ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp dpt:ssmtp state NEW,ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp dpt:smtp state NEW,ESTABLISHED

DROP icmp -- anywhere anywhere limit: avg 15/sec burst 5

REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain FORWARD (policy DROP)

target prot opt source destination

REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

ACCEPT udp -- anywhere anywhere udp spt:20 state ESTABLISHED

ACCEPT udp -- anywhere anywhere udp spt:fsp state ESTABLISHED

ACCEPT udp -- anywhere anywhere udp spt:domain state ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp spt:ssh state ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp spt:https state ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp spt:www state ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp spt:ssmtp state ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp spt:smtp state ESTABLISHED

ACCEPT tcp -- anywhere anywhere tcp multiport sports tcpmux:63665 state

NEW,ESTABLISHED

ACCEPT icmp -- anywhere anywhere icmp any

Chain fail2ban-ssh (1 references)

target prot opt source destination

RETURN all -- anywhere anywhere

root@www:~#

All was working up till this morning and we have not made any changes.

Thanks

4 Replies

forum:Guspaz · Answer 1 · Sept. 19, 2012, 7:57 p.m.

forum:Guspaz 12 years, 2 months ago

I assume the first is your INPUT chain (you cut that off)? You don't seem to have a rule to accept SSH traffic, so it would follow that SSH traffic wouldn't get through.

Your output chain appears pointless, since the policy is to accept by default, and then you have nothing but accept rules.

forum:premiumts · Answer 2 · Sept. 19, 2012, 8:03 p.m.

forum:premiumts 12 years, 2 months ago

Guspaz Thank you. I am all new to this and the person that set all this up is no where to be found. My question then would be how would I add the rule for ssh and sftp on the input side? I am trying to read and understand as this is all new to me. If you can help that would be great

forum:Guspaz · Answer 3 · Sept. 19, 2012, 9:31 p.m.

forum:Guspaz 12 years, 2 months ago

I'm really not an iptables whiz, when I need to do firewalling I tend to use ufw (Ubuntu's uncomplicated firewall), so I can't really offer specific instructions. I can just tell that your rules are missing some stuff.

However, the Linode Library has a wealth of material on all sorts of topics, including iptables:

http://library.linode.com/security/firewalls/iptables

They also have some more general security info:

http://library.linode.com/security/basics

forum:premiumts · Answer 4 · Sept. 19, 2012, 9:38 p.m.

forum:premiumts 12 years, 2 months ago

Thank you Guspaz. I got it and it is working. Thanks for all the info

Compute

Storage

Networking

Databases

Services

Developer Tools

Industries

Pricing

Community

Engage With Us

HELP Cant connect to server via SSH or SFTP

4 Replies

Reply

Tips: