topic Re: file blocking profile not working for SFTP in General Topics

file blocking profile not working for SFTP

sumit_mame — Sat, 03 Jun 2023 10:11:25 GMT

Hii

we are trying to access our internal storage using SFTP from internet. after applying file blocking profile we are able to access mentioned files but firewall not restrict the file. we found that file blocking is not happening.

Please advise how to block files when using SFTP.

Re: file blocking profile not working for SFTP

InfoSecPro — Sun, 04 Jun 2023 19:53:56 GMT

Hi Sumit!

Having decription in place is a pre-requisite to being able to use the file blocking profile. Having decription configure is important because not having that means other security features are not working. Once you do that, it will detect the file and start working.

Inf0S3cPr0

Re: file blocking profile not working for SFTP

TomYoung — Mon, 05 Jun 2023 13:04:10 GMT

Hi @sumit_mame and @InfoSecPro ,

SFTP is SSH File Transfer Protocol. https://en.wikipedia.org/wiki/SSH_File_Transfer_Protocol You can verify this by looking at the application identified by the NGFW. It should be ssh.

While the NGFW can decrypt SSH, I believe it is only for the purpose of identifying the ssh-tunnel application. So, I don't think SFTP can be identified or decrypted, which would be required to identify the file. In addition, "SFTP is not FTP run over SSH" (URL above). The protocol is different, and if the SSH session were decrypted, it would not be identified as ftp.

If the application is FTPS, then the NGFW will identify it as ssl. Then you could decrypt it, and the NGFW should identify the traffic as FTP. Then the file can be identified and blocked.

Thanks,

Tom

Re: file blocking profile not working for SFTP

sumit_mame — Mon, 05 Jun 2023 05:05:17 GMT

Thanks tom for clarification.

Do you have any ideas for secure transfer of files that include file blocking?

Re: file blocking profile not working for SFTP

TomYoung — Mon, 05 Jun 2023 13:08:32 GMT

Hi @sumit_mame ,

Does your server support FTP over SSL, or FTPS? If so, use that and configure SSL Inbound Inspection on your NGFW. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/decryption/configure-ssl-inbound-inspection

Second, please submit a feature request to your PANW SE to decrypt and decode SFTP. I think a lot of customers would find that useful.

Thanks,

Tom