How do I shut down ports remotely without shutting myself out?

Question

I have an Ubuntu 11.04 server in a remote location on another continent, so I have no physical access to it. I only interact with it by ssh (and scp), and intend to only ever interact with it that way.

For security purposes, I want to ensure that absolutely all ports on the server are closed, except for ssh.

My understanding is still vague, despite having tried to find instructions on the web. What I've gathered so far is that I need to "flush" the "iptables", and also that I need to edit some files (/etc/hosts, maybe?), and reboot the machine.

Obviously, though, I want to be very careful about this, because if I do it wrong, I could end up accidentally shutting down the ssh port, making the server inaccessible to me. If that happens, I have to go to the server administrator, who will reinstall the server, and make fun of me in the process.

I'm not a server admin guru by any stretch, so I'm looking to establish a fool proof set of steps before I do this.

So, how do I shut down all ports while still preserving my access?

Bonus question: While doing this, should I, and can I, change the ssh port from 22 to a non-standard one? Does it really make a difference?

Answer 1

First write a little script to flush the iptables rules:

#!/bin/bash
echo "Stopping firewall and allowing everyone..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

(You probably don't need the 'nat' and 'mangle' commands.) Call it 'flush.sh' and put the script in the '/root' directory. Remember to 'chmod +x flush.sh'.

Test the script by adding a harmless iptables rule such as

iptables -A INPUT -p tcp -j ACCEPT

and then running the script from the command line. Verify that the rule that you added is gone.

Add the script to root's crontab to run every ten minutes:

*/10 * * * * /root/flush.sh

Add back the harmless iptables rule that you used to test the script. Wait ten minutes and verify that your cron job executed successfully and removed the rule.

At this point you should be able to debug your iptables rule set with the flush.sh safety net running every ten minutes. When you are finished debugging your rules, comment out the line in crontab that runs the flush.sh script.

Where you put your rules is somewhat distro dependent. For Ubuntu, have a look at this link. Towards the end you will see two options for setting up your firewall rules permanently - /etc/network/interfaces and by using the Network Manager configuration. Since you are running a server, the former option is probably better.

You shouldn't ever need to reboot in order to change or flush your iptables rules, unless you lock yourself out.

It is best to configure sshd to only allow root login using public key authentication rather than by password.

If you have a secure gateway available with a fixed IP address such as a server at your office that you can log into from anywhere, it would be good to have an iptables rule on the remote server to allow SSH only from that gateway.

Changing the SSH port from 22 to something else is of very limited value as most port scanners will find the new SSH port quickly.