Funny ssh issue after power outage

[m33ts4k0z]

Hello,

After a power outage, my AC88U restarted. Everything is working fine but I noticed that the web gui is not accessible. I tried to ssh to the router and that is working fine as well. However when I try to execute a command, nothing happens. I receive no error and no output either. I just want to reboot the router but im not able too. I am in another country now and ive asked a friend to physically reset the router but since it will take some days for him to get to my appartment, is there anything else i can do remotely to solve this issue? All devices connected to the router work correctly so its not a big deal. its more that its funny and that im curious.

Thanks in advance

 

[martinr]

I presume you are connecting directly through SSH remotely and not down a remote vpn connection. Remote direct SSH connection is not advised (security reasons) and all the more so if you are connecting on the standard Port 22. So if that is the case, once you are up and running again, set up both OpenVPN Servers on your router (one can be a backup if you mess up a setting remotely); it is not in the least difficult. Then you can connect to the webui via OpenVPN, which is the advised method, and, if you need an SSH connection, that is just as if you were back home.

As for doing anything the get your SSH connection back before your good samaritan reboots it, there’s not a lot you can do other than keep trying every few hours. Can you ping the router via your DDNS address? (Only worth trying if it normally respond to a remote ping anyway.). If you do a look-up for the IP address associated with your DDNS address, do you get a sensible answer?

Other than that, have you had any other odd glitches or is this the first one? Which firmware, by the way?

 

[m33ts4k0z]

Hello.
The ssh is indeed open but not on standard port. However this is not a security issue for me since i have a rather complex setup. I use reverse proxy over ssl to expose the gui having wan access disabled so this is also covered. I use a dedicated debian system that i host a softether server for my vpn needs. But the issue that im facing has happened for the first time thats why i was curious. I use the merlin 384.12 firmware

 

[martinr]

Hello.
The ssh is indeed open but not on standard port. However this is not a security issue for me since i have a rather complex setup. I use reverse proxy over ssl to expose the gui having wan access disabled so this is also covered. I use a dedicated debian system that i host a softether server for my vpn needs. But the issue that im facing has happened for the first time thats why i was curious. I use the merlin 384.12 firmware

Good to know you’re happy with your setup. Please do let us know how it works out, especially if you get your connection back before the Good Samaritan reboots.

 

[dave14305]

What commands are you running?

service restart_httpd

or

service reboot

Incorrect service commands don't complain.

 

[martinr]

What commands are you running?

service restart_httpd

or

service reboot

Incorrect service commands don't complain.

Good point; I didn’t read it closely enough. Re-reading the post, I see what you mean.

 

[olabukky]

Off topic,unless you have government secrets behind a known IP I wouldn't worry about open SSH port. Random port and strong password is sufficient unless the world falls down on you with successful attempt. I see on average 1 attempt a day to non existent (root) user.

You can rate limit attempts with iptables as well.

 

[dave14305]

Off topic,unless you have government secrets behind a known IP I wouldn't worry about open SSH port. Random port and strong password is sufficient unless the world falls down on you with successful attempt. I see on average 1 attempt a day to non existent (root) user.

You can rate limit attempts with iptables as well.

You also have to trust that the BusyBox implementation of ssh is up-to-date with fixes for known vulnerabilities. I personally don’t think of my secrets being at risk so much as my router becoming another pawn in a DDoS attack if compromised.

Everyone has their own tolerance for risk, yours is higher than mine, and it’s unnecessary risk when the OpenVPN server solution is available.