The safety-net timer in Step 3 is the part that usually gets skipped, and it's the one that saves you. Especially the note about keeping nohup — I've seen people lose the disable job when the SSH session that started it died, which is exactly the lockout case.
Also appreciated calling out leftover ufw allow ssh / Anywhere rules and that first-match order means the IP allow changes nothing until that line is gone. Using $SSH_CLIENT instead of a "what is my IP" site is the other detail that avoids a surprising source address behind NAT or a provider mapping.
c-wind
Building developer tools around SSH and terminals. Rust, Linux, ops.
The safety-net timer in Step 3 is the part that usually gets skipped, and it's the one that saves you. Especially the note about keeping
nohup— I've seen people lose the disable job when the SSH session that started it died, which is exactly the lockout case.Also appreciated calling out leftover
ufw allow ssh/Anywhererules and that first-match order means the IP allow changes nothing until that line is gone. Using$SSH_CLIENTinstead of a "what is my IP" site is the other detail that avoids a surprising source address behind NAT or a provider mapping.