How can I recover SSH access to a amazon EC2 instance after UFW firewall activation by accident?

Question

I have activated UFW firewall in an EC2 ubuntu server 12.04 instance, but I forgot to allow access to port 22. Now I can't connect to the instance via SSH. This instance is EBS backed.

How can I recover SSH access to a amazon EC2 instance after UFW firewall activation by accident?

Intranuclear

Answer 1

Well, thanks to EBS there is a solution.

1. Stop your instance
2. Attach your EBS volume to another instance. if you don't have one, create a micro instance.
3. Mount yor EBS volume somewhere ie. /opt/recover
4. List item
5. Edit {your-ebs-mount}/etc/ufw/ufw.conf and change enabled=yes to enabled=no
6. Umount the EBS
7. Detach from the temp instance
8. Reattach to the original instance. (make sure to attach as root)
9. Restart the instance

Now you firewall is disbled in your instance, so you can access it via ssh.

Intranuclear

Glad you found the answer! – Upgrowth

@Intranuclear I love you man ! Just one thing to add to this. When you re attach your drive (if it was your root drive or only drive), make sure you attach it to the correct mount point aka sda1 – Asexual

If you create a new instance remember to create in on the same Availability Zone as it is not possible to attach volumes to different Zones. – Merriweather

This is why I love this community. Thank you so much! – Harberd

You just saved me an incredible amount of time, thank you. – Clearsighted

Answer 2

Step 1: Open view/change user data in instance settings.
Step 2: Add the script(mentioned below) and save it.

#cloud-config
bootcmd:
- cloud-init-per always fix_broken_ufw_1 sh -xc "/usr/sbin/service ufw stop >> /var/tmp/svc_$INSTANCE_ID 2>&1 || true" 
- cloud-init-per always fix_broken_ufw_2 sh -xc "/usr/sbin/ufw disable>> /var/tmp/ufw_$INSTANCE_ID 2>&1 || true"

Step 3: Restart the instance:(machine ip will be changed) Script will executed on boot, ufw will be disabled.

Now we can connect the instance through ssh.

Reference(step by step with screenshot): https://github.com/ibrahim45/configuration/blob/master/boot_script_instance.md

Ipa

Thanks brother..I was facing this issue for past 2 days..thank you.. It should be an accepted answer. – Kazbek

Long live brother, this is a quick and easy fix thanks – Mortonmortuary

Definitely should be the accepted answer. I spent quite some time to what I did wrong. Finally understood I activated the firewall by mistake. Lesson: Always manage ports from security groups! – Affliction

Answer 3

Another way, super easy: Easiest way is to update the instance's user data

Stop your instance

Right click (windows) or ctrl + click (Mac) on the instance to open context menu, then go to Instance Settings -> Edit User Data or select the instance and go to Actions -> Instance Settings -> Edit User Data

If you're still on the old AWS console, select the instance, go to Actions -> Instance Settings -> View/Change User Data

And paste this

Content-Type: multipart/mixed; boundary="//"
MIME-Version: 1.0
--//
Content-Type: text/cloud-config; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="cloud-config.txt"
#cloud-config
cloud_final_modules:
- [scripts-user, always]
--//
Content-Type: text/x-shellscript; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="userdata.txt"
#!/bin/bash
ufw disable
iptables -L
iptables -F
--//

Once added, restart the instance and ssh should work. The userdata disables ufw if enabled and also flushes any iptable rules blocking ssh access

Antonyantonym

Answer 4

my EC2 instance is inaccessible and in /etc/ufw/ufw.conf enabled is already set to no as enabled=no

I have tried the user data script as well but still no success.

Content-Type: multipart/mixed; boundary="//"
MIME-Version: 1.0
--//
Content-Type: text/cloud-config; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="cloud-config.txt"
#cloud-config
cloud_final_modules:
- [scripts-user, always]
--//
Content-Type: text/x-shellscript; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="userdata.txt"
#!/bin/bash
ufw disable
iptables -L
iptables -F
--//

Carrot