Re: SSH & iptables

Thanks for answers.


Alex Samad wrote:
On Mon, May 25, 2009 at 12:53:58PM +0100, Nuno Magalhães wrote:
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

but that will not work how you expect (don't implement it remotely )
How would one implement it remotely? I (may have) read somewhere that
blocking everything but ssh wouldn't mess with your ssh session, but
i'm not sure.

the above line would allow ssh only traffic but block everything else,
like ntp, dns, email, icmp - both inbound and outbound

maybe your should read a bit more about firewall/iptables. I believe
other people recommend shorewall as an easy / safe application to use
for firewalls.

I would also suggest if you are doing this remotely (and you have no
access to the console).

investigate screen, have one window left open with a command line
something like this running

sleep 500 && <command to undo what you are testing>

Alex


Would a cron job or a sleep do?




--
To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx with a subject of "unsubscribe". Trouble? Contact listmaster@xxxxxxxxxxxxxxxx

Relevant Pages

  • Re: SSH & iptables
    ... iptables -A INPUT -j DROP ... blocking everything but ssh wouldn't mess with your ssh session, ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ... Trouble? ...
    (Debian-User)
  • Re: Terminal clock (script)
    ... It's also useful in ssh session on my server, ... I replaced vcstime years ago with my own version that displays more information (minutes of battery left, free MB's, CPU temp, CPU %, VT#, dow, date, time) and is a daemon, all of which are changeable with a companion dialog piece, the 2 communicate over a port. ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx with a subject of "unsubscribe". ...
    (Debian-User)
  • Terminal clock (script)
    ... A script that ... It's also useful in ssh session on my server, ... just hangs, while new are established and ping is working. ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)
  • Re: tty migration
    ... I thought screen was a way to get many virtual-virtual terminals from ... It will work also if you accidentally close a SSH session. ... n@plinko:~/svn/fuwiki$ svn update ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx with a subject of "unsubscribe". ...
    (Debian-User)