topic Re: ssh (or any) threshold? in General Topics

ssh (or any) threshold?

VSU_ITSEC — Thu, 28 Aug 2014 12:44:36 GMT

I'm experiencing a ton of hits over ssh to servers that must have ssh access. Is there a way to do threat assessment based on SSH, port etc – and then automatically shut the attack down? For example if a certain IP begins sending all that traffic on port 22 within a certain timeframe – we shutdown the traffic and blacklist the IP. What would be better is to limit this rule to a certain scope – say all of China and Korea where we know attacks tend to happen from – this will help keep down false positives.

thanks

//moe

Re: ssh (or any) threshold?

_slv_ — Thu, 28 Aug 2014 13:00:14 GMT

Are You sure that You have properly configured Threat prevention (enabled on policy that allowing ssh access to servers)?

Look https://threatvault.paloaltonetworks.com/Home/ThreatDetail/40015

there is an id40015 SSH User Authentication Brute-force Attempt signature exactly for Your case.

Regards

Slawek

Re: ssh (or any) threshold?

VSU_ITSEC — Thu, 28 Aug 2014 13:14:01 GMT

i believe so. the connections don't match that vulnerability, which i have "reset-both" assigned to it.

Re: ssh (or any) threshold?

VSU_ITSEC — Thu, 28 Aug 2014 13:26:15 GMT

sample

Re: ssh (or any) threshold?

hshah — Thu, 28 Aug 2014 17:21:26 GMT

Hi VSU,

Try with DOS Protection or Zone Protection. You should be able to cofigure values in it.

Regards,

Hardik Shah

Re: ssh (or any) threshold?

hshah — Thu, 28 Aug 2014 19:01:48 GMT

Hi VSU,

Following Signature will not trigger fo 10 attemts in 1 hour. Count is much higher than that. I guess its around 60 per minute as long as I know.

https://threatvault.paloaltonetworks.com/Home/ThreatDetail/40015

Regards,

Hardik Shah

Re: ssh (or any) threshold?

_slv_ — Fri, 29 Aug 2014 18:37:32 GMT

Hi VSU

You can verify using custom reports that more than 10 atemp per hour hapend. If yes, Please make a pcap for further troubleshooting by PA support.

Regards

SLawek

Re: ssh (or any) threshold?

Dz3015 — Fri, 28 Nov 2014 17:20:11 GMT

VSU_ITSEC

I agree with hshah , you could add a DOS profile to your specific SSH rule to throttle sessions.