I have an Ubuntu 11.04 server in a remote location on another continent, so I have no physical access to it. I only interact with it by ssh (and scp), and intend to only ever interact with it that way.

For security purposes, I want to ensure that absolutely all ports on the server are closed, except for ssh.

My understanding is still vague, despite having tried to find instructions on the web. What I've gathered so far is that I need to "flush" the "iptables", and also that I need to edit some files (/etc/hosts, maybe?), and reboot the machine.

Obviously, though, I want to be very careful about this, because if I do it wrong, I could end up accidentally shutting down the ssh port, making the server inaccessible to me.

I'm looking to establish a fool proof set of steps before I do this.

So, how do I shut down all ports while still preserving my access?

Bonus question: While doing this, should I, and can I, change the ssh port from 22 to a non-standard one? Does it really make a difference?

  • 4
    You shouldn't need to reboot the machine, it will probably boil down to just a bunch of iptables to deny incoming connections. If you can take a bit of downtime, you can use the at command to run commands once at a specified time, so, for example, you could reinstante your original configuration files (and reload config) two hours later, so even if you lock yourself out by misconfiguration, the system will revert to the previous state. If it does work, use atrm to cancel the at command. – Ulrich Schwarz Apr 27 '12 at 6:09
  • 2
    If you are not a full-time sysadmin, you'd probably make life easier on yourself by using an iptables frontend. I use ferm. It requires perl but the configuration is intuitive, and it is installed as a "service" whose start and stop scripts handle the loading and unloading of iptables rules. Your bonus question about ssh ports is a bit off-topic. Check your auth logs. If you see a large number of crack attempts on your ssh port, and your server is for personal / private use only, I'd recommend changing the default port. – jw013 Apr 27 '12 at 6:19

First write a little script to flush the iptables rules:

echo "Stopping firewall and allowing everyone..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT

(You probably don't need the 'nat' and 'mangle' commands.) Call it 'flush.sh' and put the script in the '/root' directory. Remember to 'chmod +x flush.sh'.

Test the script by adding a harmless iptables rule such as

iptables -A INPUT -p tcp -j ACCEPT

and then running the script from the command line. Verify that the rule that you added is gone.

Add the script to root's crontab to run every ten minutes:

*/10 * * * * /root/flush.sh

Add back the harmless iptables rule that you used to test the script. Wait ten minutes and verify that your cron job executed successfully and removed the rule.

At this point you should be able to debug your iptables rule set with the flush.sh safety net running every ten minutes. When you are finished debugging your rules, comment out the line in crontab that runs the flush.sh script.

Where you put your rules is somewhat distro dependent. For Ubuntu, have a look at this link. Towards the end you will see two options for setting up your firewall rules permanently - /etc/network/interfaces and by using the Network Manager configuration. Since you are running a server, the former option is probably better.

You shouldn't ever need to reboot in order to change or flush your iptables rules, unless you lock yourself out.

It is best to configure sshd to only allow root login using public key authentication rather than by password.

If you have a secure gateway available with a fixed IP address such as a server at your office that you can log into from anywhere, it would be good to have an iptables rule on the remote server to allow SSH only from that gateway.

Changing the SSH port from 22 to something else is of very limited value as most port scanners will find the new SSH port quickly.

| improve this answer | |
  • Thank you for these detailed instructions. The only parts I am not clear on are: What is an exampleof a *harmless iptables rule"? And how exactly would I "debut my ip rules set"? Also, thank you for the clarification about port 22, and the tip to disable password login. – Questioner Apr 28 '12 at 9:02
  • Edited answer to address comment. – Eli Rosencruft Apr 28 '12 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.