LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 12-22-2005, 10:50 AM   #1
shegman
LQ Newbie
 
Registered: Dec 2005
Location: Germany
Distribution: Slackware
Posts: 8

Rep: Reputation: 0
i banned myself from my remote ssh-server...i need an idea to fix it :)


I connect to my remote machine with ssh. One day i worked on it i saw (with 'tail -f' in the logs), that somebody is trying to brute-force into the machine.
ok, i thought, nothing can happen. you have a good password.
nevertheless i changed the original port from 22 and turned root login off. before i did that on my remote machine, i tried it locally. on the local machine is everything fine.
but since then i cannot login to the remote machine.

what can i do now?
thanks for any help.
 
Old 12-22-2005, 11:15 AM   #2
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 128Reputation: 128
Can you even access the ssh server? What errors do you get when you try to login? Please give details.
 
Old 12-22-2005, 11:27 AM   #3
shegman
LQ Newbie
 
Registered: Dec 2005
Location: Germany
Distribution: Slackware
Posts: 8

Original Poster
Rep: Reputation: 0
oh sorry, forgot that.
the machine respond pings. the webserver is running.

when i try to ssh to it, it only times out. nothing else happens.
is it lost, or is there a chance to connect some time again...?
 
Old 12-22-2005, 11:29 AM   #4
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 128Reputation: 128
If you changed the port on which ssh is running, are you trying to connect to the new port?
 
Old 12-22-2005, 11:42 AM   #5
michaelk
Moderator
 
Registered: Aug 2002
Posts: 21,821

Rep: Reputation: 4254Reputation: 4254Reputation: 4254Reputation: 4254Reputation: 4254Reputation: 4254Reputation: 4254Reputation: 4254Reputation: 4254Reputation: 4254Reputation: 4254
Could be your firewall too. You need to change it to allow incoming connections on the new port.
 
Old 12-22-2005, 11:46 AM   #6
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 128Reputation: 128
If he's firewalled off on the port, that'll be real fun. I guess he'll need to get someone local to the machine to work on it.
 
Old 12-22-2005, 11:47 AM   #7
shegman
LQ Newbie
 
Registered: Dec 2005
Location: Germany
Distribution: Slackware
Posts: 8

Original Poster
Rep: Reputation: 0
yes. i try it like that 'ssh x.x.x.x -p 245' then it says
'ssh: connect to host x.x.x.x port 245: Connection timed out'

and on the default port 22 it says, like expected
'ssh: connect to host x.x.x.x port 22: Connection refused'
 
Old 12-22-2005, 11:56 AM   #8
shegman
LQ Newbie
 
Registered: Dec 2005
Location: Germany
Distribution: Slackware
Posts: 8

Original Poster
Rep: Reputation: 0
i have a firewall on that machine. it is a SUSE machine.
in yast you can choose which service should not be firewalled. sshd was open, before i changed the port. i dont know much about firewalls, but shouldnt the SUSE firewall update automatically?
 
Old 12-24-2005, 11:34 AM   #9
shegman
LQ Newbie
 
Registered: Dec 2005
Location: Germany
Distribution: Slackware
Posts: 8

Original Poster
Rep: Reputation: 0
Does no one have any ideas, what i can do now?

Perhaps not really legal methods? i mean, the server belongs to me, so...
 
Old 12-24-2005, 12:29 PM   #10
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD, Raspbian, Arch
Posts: 2,285

Rep: Reputation: 354Reputation: 354Reputation: 354Reputation: 354
Quote:
Originally Posted by shegman
Does no one have any ideas, what i can do now?
Well, since you say you use ssh, I'd assume that means you disabled telnet and the "r" commands (rsh, rcp, etc.). But maybe that's a bad assumption and you could still get in that way... (...and if so, you need to review you system security!)
 
Old 12-24-2005, 01:18 PM   #11
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD, Raspbian, Arch
Posts: 2,285

Rep: Reputation: 354Reputation: 354Reputation: 354Reputation: 354
Quote:
Originally Posted by shegman
yes. i try it like that 'ssh x.x.x.x -p 245' then it says
'ssh: connect to host x.x.x.x port 245: Connection timed out'
This is a passive response. e.g., the packet was dropped (no reply was sent back to you).
Quote:
Originally Posted by shegman
and on the default port 22 it says, like expected
'ssh: connect to host x.x.x.x port 22: Connection refused'
This is an active response. You got through to your server, but it replied back to you "Sorry, this port is closed or no service is running there".

The passive response could be caused by your firewall rules that say DROP instead of REJECT. Or it could be caused because your server is behind a router and that router is set up to port forward port 22 but not port 245. Or your ISP may be blocking traffic on port 245. That port is normally assigned to something called "link". I have no idea what that service is or if an ISP might be inclined to block it.

If the problem is your router, can you login to the router from the WAN side and add a port forwarding rule? If the problem is your firewall dropping traffic on port 245 you're probably in for some real headaches. Its doing exactly what its supposed to.

Did you set up your sshd alternate port in your system config files? (i.e., will it persist past a system reboot?) If you set it up for the current boot session only, you could try researching cracker websites and attempt to crash your remote computer via some exploit (if you have it setup to automatically reboot after a crash). This would be pretty drastic!
 
1 members found this post helpful.
Old 12-24-2005, 02:09 PM   #12
shegman
LQ Newbie
 
Registered: Dec 2005
Location: Germany
Distribution: Slackware
Posts: 8

Original Poster
Rep: Reputation: 0
oh man. thats bad.
i think its the firewall.

and i changed the port in the sshd_config. so i think it is persistent.

but thank you a lot for all the answers.

merry christmas
 
Old 12-24-2005, 02:41 PM   #13
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD, Raspbian, Arch
Posts: 2,285

Rep: Reputation: 354Reputation: 354Reputation: 354Reputation: 354
Quote:
Originally Posted by shegman
oh man. thats bad.
i think its the firewall.
Merry Christmas to you too!

You aren't running your webserver as root, are you? That would be a horrible security breach, but could be your ticket into your locked system. Fix this hole ASAP after getting back in if this is the case with your server....

[edit]
Upon further reflection, I deleted the suggestion that I had put here. A simple, older, and widely known way to compromise an insecure webserver running as userid root. Not an appropriate thing to post however. My apologies for my lack of forethought.
[/edit]

...And hopefully you're not running things like webservers as userid root in the first place! But you sound desperate so I'm suggesting desperate things.

Last edited by haertig; 12-24-2005 at 02:52 PM.
 
Old 12-25-2005, 09:59 AM   #14
fur
Member
 
Registered: Dec 2003
Distribution: Debian, FreeBSD
Posts: 310

Rep: Reputation: 35
Quote:
Originally Posted by shegman
Does no one have any ideas, what i can do now?

Perhaps not really legal methods? i mean, the server belongs to me, so...

If its your equipment call up the colo or wherever its located, have them login for you, and change things back to the defaults.
 
Old 12-25-2005, 10:37 AM   #15
shegman
LQ Newbie
 
Registered: Dec 2005
Location: Germany
Distribution: Slackware
Posts: 8

Original Poster
Rep: Reputation: 0
that would cost a lot.
thats why i asked here before.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
SSH : Takes a long time to login to a remote server TomCruise2002 Linux - Networking 8 12-04-2011 01:01 PM
SSH : Takes a long time to login to a remote server TomCruise2002 Linux - Enterprise 1 12-16-2005 06:58 PM
Remote server, unable to SSH anymore Keiser Linux - Newbie 1 05-06-2005 10:13 PM
matlab on remote linux server... using ssh .. x display shyamsg Linux - Networking 1 05-01-2004 04:01 PM
copy files using SSH from a server to another..both remote Santosh_d Linux - Networking 6 03-10-2004 11:02 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 06:00 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration