Skip to content
Register

Funny: I typo'd my SSH port and locked myself out for 6 hours

General Discussion by salavi 21 replies 2.5K views
Richard7

Member

Pentium III Enjoyer

#11

readerkrakw said:
9600 baud console cable
Still have mine. DB9 to RJ45, Cisco rolled, the whole set. Use it maybe once a year when someone's "cloud native" kubernetes cluster decides it doesn't want to cloud anymore and I need to see what the bare metal underneath thinks about that.

SPARCstation 20, still serving HTTP
paolo62

Member

#12

I typo'd my router's lan ip once. Set it to 192.168.2.255. Took me two hours to figure out why nothing could get a dhcp lease. Ramen was cold by the time I fixed it.

walt22

Member

Austin

9 #13

mediaaustin said:
Port 22222 is in the ephemeral range
This is the real takeaway. IANA ephemeral starts at 49152, but Linux defaults to 32768-60999, and a lot of scanners don't care about the distinction. Still, anything above 1024 without a specific service registered is just asking for a collision someday. I knew a guy who ran ssh on 8080 because "firewalls let it through." They also let every proxy and tomcat through. He had logs full of CONNECT attempts. — https://www.iana.org

steveipw

Member

#14

salavi said:
IPMI costs more than the vm
Fair. My kit is for boxes I own. For vms I keep a second sshd on port 443 running dropbear with a separate key, on a separate systemd unit that doesn't read the main config. It's my escape hatch. Hasn't failed me yet.

zfs send | zfs receive. repeat.
reykjavik_doc

Member

container skeptic

#15

steveipw said:
Separate systemd unit
This is exactly the kind of complexity that makes me miss rc.local. I have one client who maintains a 47-line systemd override for sshd because they wanted to log failed attempts to a separate journal namespace. I asked why. They said "observability." I said "you have twelve users." They said "but what if we scale?" They have not scaled in four years.

BI

Member

#16

In France we have a saying: "Jamais deux sans trois." Never two without three. I have locked myself out of OVH, Scaleway, and a dedibox. The OVH one was the worst because their rescue mode requires you to acknowledge an email they send to the server admin address, which was on the server. Took a fax to their Paris office to recover. A fax. In 2019.

SA

Member

2 #17

My provider is one of the local ones in Buenos Aires, no VNC console, no rescue, just a ticket system that answers between 10am and 4pm on business days. I have three layers of fallback ssh configs and I still test them drunk because that's the most realistic threat model for a Saturday night deploy.

herebungkus

Member

🌏 SEA represent

#18

samuelmus said:
Test them drunk
This is actually smart. I have a client who only remembers his passwords when he's had two beers. We call it "muscle memory with relaxation." For my warung clients I keep everything simple: key auth, port 22, fail2ban, no creativity. Their threat model is "nephew who 'knows computers' changes something."

wrap it, ship it, pray it
LA

Member

#19

Has anyone tried using mosh as a fallback? It runs over UDP and can survive IP changes, but I wonder if it would have helped here since the port was just wrong, not the IP.

mediaaustin

Member

Deliverability Nerd

7 #20

LayerZhao said:
Mosh as a fallback
Mosh still needs to establish the initial ssh connection to spawn mosh-server. Wrong port, no mosh. It's great for flaky coffee shop wifi, not for config typos.

SPF, DKIM, DMARC — holy trinity ✉️

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft