So the title says it all. I setup an ec2 instance on AWS running Ubuntu 16.04 LTS for a web server. When enabling the firewall, and opening ports needed for a web access (HTTP, FTP, ect.), I didn't think to enable port 22 for the SSH connection I use to connect to the server. Naturally I'm unable to remote into my server via SSH to manage it since its now being blocked by UFW. Luckily I'm still able to connect via FTP so I have access to all of the systems files. What are my options to get port 22 on the UFW open?
-
also - unless you have a REALLY REALLY GOOD reason to run it, leave ftp off.– warrenJun 13, 2017 at 15:20
-
Could you elaborate on this? This was a LAMP server to run my personal website. What's another practical way to upload the files for my website? Do you say that because FTP isn't secure?– Tyler BradyJun 13, 2017 at 15:24
-
Not only is ftp not secure, it's a very common attack vector: use key-based authentication, then use scp or sftp (same port as ssh is running on). Otherwise anyone who guesses your credentials can deface your website, upload junk there, make it part of a ddos, etc.– warrenJun 13, 2017 at 15:27
-
1Great advice. I just watched a video on how insecure FTP is. I had no idea. I'll definitely be using SFTP moving forward!– Tyler BradyJun 13, 2017 at 15:36
2 Answers
If you've done nothing else yet, blow-away the instance, and redo it. That's the best, simplest, and fastest solution.
Does Amazon have a recovery console for instances? I seem to recall they do. If they do, you could reboot the instance into a rescue mode, chroot
into it, and change UFW settings that way.
You might also be able to upload a replacement sshd_config
and move sshd to listen on port 80.
Then upload an httpd config that changes its listening port to, say, 8080.
Then reboot, and ssh on port 80.
-
1Thanks for the advice warren. I couldn't find a recovery console via aws. I also tried changing the ports on sshd_config and ports.conf in apache via FTP. Unfortunately when I setup FTP I didn't give my user permission to make changes outside of the www folder so I was unable to replace those particular files once edited, otherwise I think this would have worked. I was trying to avoid redoing the instance since I already had the LAMP setup completely installed and working, but it looks like I'll just have to bite the bullet. Thanks again for help! Jun 13, 2017 at 14:55
-
You could create a replacement ssh configuration file and change the port number so that it listens on a port which is open by default and then upload this using ftp and restart the instance of Ubuntu. This would cause ssh to listen on that port, by when you can then change the ufw settings so that ssh can work in port 22.
-
This doesn't work if they don't have SSH direct access - they will need to restart the SSH service, which might not work for them.– Thomas Ward ♦Jun 13, 2017 at 14:24
-
1
-
But that won'ot work if UFW is blocking the service. That's the firewall - not sshd.– Thomas Ward ♦Jun 13, 2017 at 15:17
-
@ThomasWard - if UFW is blocking the port, it will work (as I suggested also). If it's blocking the service, you are correct. help.ubuntu.com/community/…– warrenJun 13, 2017 at 15:22