0

How can I turn off SSH and HTTP services for everybody except myself?

Background: Our server is running inside a VM. I make a snapshot of the VM before starting maintenance. When something goes wrong, I simply restore the snapshot, so I can start over again. However, if somebody uses the server while I am updating, all of his or her work in that time will be lost when I restore the snapshot. To avoid this, I want to make sure nobody can use the server during maintenance time.

I'm not the owner of the VM, so I can't take it off the network. I need to log on to the server through VPN like everybody else.

HTTP is not needed for maintenance, but I'm not sure if the server likes it if I simply stopped the service. In my case it's a GitLab server that typically refuses to update when its services are down, or its update scripts simply restart the service before migration starts. However, I'm interested in a solution that works for other Ubuntu-based servers, too.

Improve this question
3
  • Please edit your question to reflect all the details you posted in the comments. It helps to keep our Q&A style tidy and could also bring more attention since an edited question gets bounced on the homepage. See also How do comments work?
    – Melebius
    Commented Dec 11, 2019 at 12:20
  • Thanks for transferring the information to your question. However, I noticed that you mentioned GitLab as the software running on the server in your comments. Why didn’t you include this information in your question? I had found your question vague from the beginning and tried to make it more specific using comments. The information about actually used technologies helps to find the best available solution which might be not clear if you only tell vague information.
    – Melebius
    Commented Dec 11, 2019 at 13:26
  • I have another server with a similar setup, but it's not running GitLab. I'd like to have a solution that works in both cases.
    – digory doo
    Commented Dec 11, 2019 at 14:05

1 Answer 1

Reset to default
2

I am not sure if you are connecting to the VM from Linux. If you are:

First, I you can limit number of SSH connections via the firewall, but be careful not to lock yourself out as well. I do not believe you can limit using SSH config files.

Second, you can setup your SSH connection to tunnel localhost, so HTTP access is only possible from the web server.

Example tunnel using ~/.ssh/config:

Host YourServer
   HostName XXX.XXX.XXX.XXX
   IdentityFile ~/.ssh/YourServerKey
   User YourUser
   LocalForward 8888 127.0.0.1:80
   LocalForward 8889 127.0.0.1:443

With tunneling available, you can add restrictions to the HTTP server config file to allow only localhost to view the site.

Example: phpMyAdmin on Apache2, localhost only

And then comment out those lines when you are ready for public access again.

Improve this answer
1
  • Thanks, I'm going to try that.
    – digory doo
    Commented Dec 11, 2019 at 14:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .