0

I have a remote Ubuntu system to which I login from my local one. Yesterday I mistakenly installed denyhosts just to do a test, on this remote machine, but the machine already had CSF-LFD installed and it seems there became some kind of conflict between them as since then I can't SSH or FTP into it from my permanent ip, although I can SSH or FTP it from other IPs just fine.

What I can do from my permanent IP is surfing in the websites based on this machine's Apache server and even access their DBs via PHPmyadmin or logging into their CMSs from a relevant URL, hence I say I'm partially blocked.

To solve it, I tried from the hosting platform console:

(
sudo apt-get purge denyhosts
sudo apt-get purge fail2ban
sudo apt-get autoremove
sudo sh /etc/csf/uninstall.sh
sudo apt-get install --reinstall openssh-server -y
sudo apt-get install --reinstall iptables -y
sudo iptables -F.
sudo reboot
)

Still, after executing this code block, my ip is partially blocked and can't SSH or FTP into the system - When I SSH tunnel from my local desktop with WSL Ubuntu: Connection closed by remote host.

Further details:

  • I didn't replace either ftp or SSH ports from 21 or 22 to something else.
  • I didn't manually block my IP on any port (but it seems it is blocked anyway).
  • /var/log/auth.log doesn't contain any serious errors besides "connection refused".

ps ax | grep ssh:

1379 ? Ss 0:01 /user/sbin/sshd -D
2362 pts/0 S+ 0:00 grep --color=auto ssh

netstat -plnt:

enter image description here

iptables -nvL:

enter image description here

My question:

What's left to cause this after the aforementioned actions and given the charts seem fine?

  • Can you post the output of "ps ax | grep ssh" and "netstat -plnt", ran locally from your remote system through your hosting providers control panel? – Foxie Apr 14 '17 at 8:03
  • Posted outputs above (in the second I putted an image as I can't copy to clipboard from hosting platform console). – JohnDoea Apr 14 '17 at 8:49
  • Thanks. Everything looks okay there; ps ax shows that sshd (the SSH daemon) is running and netstat -plnt shows that it is listening and waiting for connections. Can you also run "iptables -nvL" and screenshot the output into your post as well? – Foxie Apr 14 '17 at 9:56
  • I just updated. – JohnDoea Apr 14 '17 at 10:07
  • Can you SSH from the server, onto itself? So ssh root@localhost for example. – Foxie Apr 14 '17 at 12:20
0

The problem was due to blockage of my permanent ip address in the file /etc/hosts.deny. To solve it I ssh'd from my laptop (because I can't copy and paste from clipboard in my hosting platform's console and that's super uncomfortable and illogistical).

Removing the ip from the file is problematic because it could then comeback due to misconfigurations or bugs so to solve it just add your permanent id to /etc/hosts.allow (which is your "always allowed" list). I did so directly from console this way (but ofcourse you can use a text editor or an ftp client like Filezilla):

bash -c "echo 'sshd: IP_ADDRESS' >> /etc/hosts.allow"

This solution deals with ip evaluation: Basically when you try to login into a remote environment, first the list of allowed ip's is checked, if your ip is in the allowed list, you get in, if it isn't, the evaluation continues to the denied list, and if your ip is there - You don't get in. To learn more on this, please see this Q&A session

After doing so, I could ssh from my permanent ip just fine. I than made sure to install CSF-LFD again, and to update everything:

  apt-get install iptables -y
  apt-get install --reinstall openssh-server -y
  cd /usr/src && rm -fv csf.tgz
  wget https://download.configserver.com/csf.tgz && tar -xzf csf.tgz
  cd csf && sh install.sh
  sed -i 's/TESTING = "1"/TESTING = "0"/g' /etc/csf/csf.conf
  csf -r && perl /usr/local/csf/bin/csftest.pl
  apt-get update && apt-get upgrade

Note:

If you prefer making changes from your laptop instead of your hosting platform console, but can't login from the laptop, make sure that your laptop's ip is different from your permanent ip.

I was sure it's different for a few hours and didn't understand why I can't login from the laptop as well but what I didn't know is that While I was away in Germany, my brother setted up a Wifi on my ip (even though I asked him not to do so). This mislead me to think that any ip is partially blocked, but I found that out and chose our other ip network and could ssh regularly to remove blockage of the permanent ip comfortably.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.