Security Sysadmin Can't SSH to the server...

how did you change SSH port number and did SSH login issues happen before or after you changed the SSH port ? As you may have forgot to update CSF Firewall's whitelist SSH port if you manually changed SSH port. If you did manually do the change, change SSH port back to 22 and then do the centmin.sh menu option 16 method below.

You can change the sshd listening port from default 22 to a number below 1024 via centmin.sh menu option 16.

Running centmin.sh menu option 16, will change your sshd listening port by

• first prompting to you enter existing sshd port = 22
• and then prompt you for your desired new sshd port and will make appropriate changes in CSF Firewall
• once change is made, DO NOT exit your current SSH session but open a new SSH session test connection to this server making sure to have changed your SSH session/profile's SSH port from 22, to the new port number you selected. See if the new separate SSH session can connect to the new sshd port. If it can, you should be good to go.

 

check if you ips are blocked using csf -g grep command

Code:

csf -g YOURIPADDRESS

commands you can see for csf via

Code:

csf -h

whitelist your ISP range of ips if you know the range

Code:

csf -a IPADDRESSORRANGE

remove temp and permanent blocks from csf

Code:

csf -tr IPADDRESS
csf -dr IPADDRESS

also check CSF /var/log/lfd.log for clues. Don't post the output of this command due to sensitive info

Code:

tail -50 /var/log/lfd.log

another log is /var/log/messages you can grep it for your ips. Don't post the output of this command due to sensitive info

Code:

grep IPADDRESS /var/log/messages

and your /var/log/secure. Don't post the output of this command due to sensitive info

Code:

tail -20 /var/log/secure

Do you have a VPN connection you can use ? Try using that to SSH into your server. If you have VPN like private one with dedicated IP, you can also whitelist that VPN IP in CSF Firewall. That's what i usually do so have multiple avenues to connect to server via SSH.

Ccheck if your ISP IP has been blocked by grepping csf firewall ips

Code (Text):

csf -g ISPIPADDRRESS

if blocked remove your ISP IP address from /etc/csf/csf.deny and restart CSF Firewall
or via command

Code (Text):

csf -dr ISPIPADDRESS

 

Centmin Mod on initial install will whitelist the ISP IP address in CSF Firewall config you logged into via SSH with. So you are less likely to experience issues of false bans. Usually, you won't need to whitelist to access SSH. CSF Firewall however has login failure detection and port flooding protection, so if a lot of failed SSH logins occur, your IP can be banned temporarily which you will see in /var/log/lfd.log log along with reason for the ban.

Port floods can occur if you initiate many connections i.e. FTP connections from same IP to a specific port CSF - Insight Guide - CSF Firewall Port Flood Blocking Pure-FTPD Connections

Getting Started Guide step 4 also outlines recommended steps for CSF Firewall whitelisting