• TimTamJimJam@lemmy.world
    118·
    4 months ago

    Happened to me in work once… I was connected via SSH to one of our test machines, so I could test connection disruption handling on a product we had installed.

    I had a script that added iptables rules to block all ports for 30 seconds then unblock them. Of course I didn’t add an exception for port 22, and I didn’t run it with nohup, so when I ran the script it blocked the ports, which locked me out of SSH access, and the script stopped running when the SSH session ended so never unblocked the ports. I just sat there in awe of my stupidity.

        • u/lukmly013 💾 (lemmy.sdf.org)@lemmy.sdf.orgEnglish
          10·
          4 months ago

          Well, the script could keep running even after he would have detached from that tmux session due to losing ssh connection. And since that script would unblock all ports after 30 seconds…

          (Same use case as nohup that they mentioned)

        • JasonDJ@lemmy.zip
          3·
          4 months ago

          Tmux essentially creates a pseudo-shell that persists between sessions.

          So you can start a process, detach the session, start something else, disconnect, come back next week, and check on it.

          It does other things too. Like console tiling.

    • krash@lemmy.ml
      3·
      4 months ago

      Out of curiousity, how would nohup make your situation different? As I understand, nohup makes it possible to keep terminal applications running even when the terminal session has ended.

      • octopus_ink@lemmy.mlEnglish
        7·
        4 months ago

        If the script was supposed to wait 30 secs and then unblock the ports, running with nohup would have allowed the ports to be unblocked 30 secs later. Instead, the script terminated when the SSH session died, and never executed the countdown nor unblock.

      • aidan@lemmy.world
        5·
        4 months ago

        the script stopped running when the SSH session ended so never unblocked the ports

  • TurboWafflz@lemmy.world
    74·
    4 months ago

    I accidentally put all the interfaces on my router running openwrt into the wrong firewall zone so now I can’t access it via ssh or the web interface. I already had it configured though and it still works so I’m just ignoring the problem until something breaks

    • incogtino@lemmy.zipEnglish
      12·
      4 months ago

      I did the same thing, set up OpenWRT perfectly, then changed the local range from 192.168.1.0 to 192.168.0.0 to suit some legacy connections. Everything works, except I can’t change settings on the router, so for now I leave it alone

    • brognak@lemm.ee
      2·
      4 months ago

      Sounds like my Unifi experience with the old CloudKeys that liked to brick themselves if the wind blew in a way they disliked. Everything still ran fine, but I couldn’t manage any of it till I factory reset it all. I think it ran like that for 3mo before I could be bothered 😅

  • jmd_akbar@aussie.zone
    361·
    4 months ago

    Whistles and looks away

    I have absolutely no idea what you’re talking about

    😜

    • sum_yung_gai@lemm.ee
      368·
      4 months ago

      UFW is a software firewall. SSH is a way to remote into computers. The joke is they turned on UFW and got locked out of the machine.

      • vort3@lemmy.ml
        391·
        4 months ago

        I’m pretty sure it was a joke.

        Everyone did this at some point, but nobody would admit such a silly thing happened to them.

        • oconnordaniel@infosec.pub
          131·
          4 months ago

          Never done this to a single server.

          Managed to write the “ufw enable, deny all” part of ansislbe script without the “allow 22” part and run it against all my homelab once.

      • jmd_akbar@aussie.zone
        71·
        4 months ago

        Hehe. I was joking there.

        Have done it randomly on my backup raspi 3 so many times 🤣

  • MrPasty@lemmy.sebbem.se
    16·
    4 months ago

    Firewallcmd’s runtime-to-permanent is one of my favorite features of any software. Set everything up, make sure everything works before making the changes permanent. If not, just reboot!

  • CronyAkatsuki@lemmy.cronyakatsuki.xyz
    9·
    4 months ago

    Happened to me, luckilly I kept an ssh connection up.

    Now I make sure to enable the firewall rules before I enable ufw ( still happened to me 3 more times ).

    • marcos@lemmy.world
      16·
      4 months ago

      You are assuming there is a keyboard and monitor plugged to it, and that the computer is somewhere nearby.

      None of those are automatically true. And when it’s nearby, it’s usually easier to just get the SD card into another computer and edit the configuration.

    • treechicken@lemmy.worldOP
      5·
      4 months ago

      That’s exactly what I did lol. Thankfully my Pi’s just in a drawer. If this was a remote host at work I would’ve already shat myself :P

  • r00ty@kbin.life
    6·
    4 months ago

    I’ve had to boot a remote server into rescue after locking myself out.

    I think most people have done this at least once.

  • 7heo@lemmy.ml
    72·
    4 months ago

    ufw is not a good software. I really tried to work with it. My solution was to disable it.

  • churisotophu@feddit.de
    4·
    4 months ago

    This literally happened to me yesterday. Fortunately ufw enable did not configure it as persistent across reboots 🤠

  • Discover5164@lemm.ee
    3·
    4 months ago

    i have ssh configured on a different port,

    more than one time i enabled ssh in ufw, restarted the service… and the connection dropped

  • JATtho@sopuli.xyz
    3·
    4 months ago

    It happened to me when I was configuring IP geoblocking: Only whitelist IP ranges are allowed. That was fetched from a trusted URL. If the DNS provider just happened to not be on that list, the whitelist would become empty, blocking all IPs. Literally 100% proof firewall; not even a ping gets a pass.