topic Re: Reset-Both for client/sftp server in General Topics

Reset-Both for client/sftp server

RiveraMarco — Fri, 29 Sep 2023 13:12:20 GMT

I have been noticing lots of traffic between an internal client to one of our Sftp server where the log states

SSH User Authentication Brute Force on Port 22 - Action Reset-Both. We have checked the client and has the correct credentials for the destination. What else should I check? The logs on the sftp server do not indicate any errors.

Re: Reset-Both for client/sftp server

Raido_Rattameister — Fri, 29 Sep 2023 13:26:22 GMT

Maybe you are transferring small files and client logs into SFTP server every time to transfer file.

By default SSH User Authentication Brute Force matches if there are more than 20 login events during 60 second period.

Re: Reset-Both for client/sftp server

RiveraMarco — Fri, 29 Sep 2023 14:03:49 GMT

Your explanation sounds reasonable. How should we address this so we don't see the traffic?

Re: Reset-Both for client/sftp server

BPry — Mon, 02 Oct 2023 14:49:36 GMT

@RiveraMarco,

Whatever vulnerability profile is assigned to the security policy matching that traffic can be updated with an exception if you feel like that's the right course of action. Ideally you would build out a specific entry for that traffic and assign it it's own profile if you proceed with that exception.