9

I turned on UFW on my ubuntu linux vm in azure, and now I can't connect to it over ssh (or anything). On both the private and public IP.

Is there any way for me to connect to my vm now? e.g. the equivalent of like an iLo interface for physical machines?

danielpops
  • 713
  • 6
  • 13
  • 2
    Given that you locked yourself out due to firewall, you might need to delete the vm (keeping the vhd), create a new linux vm, and attach your old vm's os disk vhd as a data disk. At least then, you can either recover content or modify the firewall setting config files as needed. – David Makogon Aug 08 '16 at 02:55

6 Answers6

15

Here is an msdn blog describing exactly this situation.

In a nutshell:

  1. Logon to the Azure portal
  2. VM Name > Extensions > Add > Select “Custom Script for Linux” > Create
  3. Upload the bash script I've appended below. Call it ufw_disable.sh
  4. Set the command as sh ufw_disable.sh
  5. Click OK, and wait for the script to deploy and execute.

The script will be run as root, so there is no need to do sudo inside the script (in fact this will cause things to fail).

ufw_disable.sh:

ufw disable
ufw status
Vince
  • 955
  • 1
  • 10
  • 22
  • Fantastic! This is exactly what I was looking for, but somehow couldn't find it on my own. FWIW, i'm now using aws in favor of azure, and I believe they have a similar capability there :) – danielpops Feb 16 '18 at 19:57
5

Even simpler with the latest Azure...what a lifesaver:

Azure Portal > Your VM > Run command > RunShellScript

In the textbox for Linux Shell Script, type:

ufw disable

ufw status

Click Run button. Done.

Rey Parma
  • 51
  • 1
  • 1
3

You can add your new IP from the cloud shell.

az vm run-command invoke -g VMResourceGroup -n VM --command-id RunShellScript --scripts "ufw allow from 74.125.90.78 to anyport 22"

Change the ip address and the port to your own values.

ra213
  • 61
  • 4
  • This should be the preferred option over creating a custom extension, as it is both the easier and faster method, and you're not left with a custom extension on your VM you'll need to cleanup. But I'll note for clarity, that you must replace `VMResourceGroup` and `VM` with your resource specific names. – Crayons Mar 15 '19 at 02:07
3

Azure portal provides the easiest way to get into the serial console through its portal. Follow these steps

Azure Portal > Your VM > Support + Troubleshooting > Serial Console.

Now even if you firewall is blocking ssh, you can access this serial console and simply disable it using sudo ufw disable or add the 22 ssh port to the firewall

Hariharnath Paduchuru
  • 137
  • 6
0

Method Provided by @Vince somehow did not work for me

even further simple solution

Setup your serial console Pic for serial console path

  1. first setup Username and password by going to support& trobleshott -> reset password
  2. open serial console -> log in
  3. sudo ufw disable [bamm...]
Mukul Varshney
  • 94
  • 1
  • 6
-3

Run this on the machine as root:

ufw allow ssh

A more strict approach would be:

ufw limit ssh
Awn
  • 817
  • 1
  • 16
  • 33