topic Re: SSH Login attempts with Root account from external IPs in General Topics

SSH Login attempts with Root account from external IPs

Shyam01 — Fri, 14 Oct 2016 05:53:12 GMT

Hello,

How can we block SSH login attempts (With root account )which are made from external IPs in Paloalto.

Note: We also have customers who login from external Ips. We dont have customer Ip list to white list.

Thanks and Regards.

Re: SSH Login attempts with Root account from external IPs

reaper — Fri, 14 Oct 2016 06:27:41 GMT

enabling an ACL would be preferable, but if this is not possible: to prevent exposing your management interface to the internet, you could set up GlobalProtect connections for your customers that need access to thte management interface

that way they'll first need to VPN into the device before they cn connect to management, which is much safer

obfuscation can also help, by enabling the management profile on a loopback interface, and then setting up a Port Address Translation policy that translates, for example, your public IP's port 22222 to the loopback internal port 22

Re: SSH Login attempts with Root account from external IPs

Shyam01 — Tue, 08 Nov 2016 09:32:26 GMT

Thank you for the information. Could you kindly provide detail information on second point or provide the referense site to undastand.

Note: As I said before, we dont have customer IPs list to whitelist.

Re: SSH Login attempts with Root account from external IPs

santonic — Tue, 08 Nov 2016 13:38:10 GMT

For GlobalProtect:

https://www.paloaltonetworks.com/documentation/71/globalprotect/globalprotect-admin-guide/globalprotect-quick-configs

Re: SSH Login attempts with Root account from external IPs

BPry — Tue, 08 Nov 2016 19:12:22 GMT

To add to this if you are remotely managing these devices then I would highly recommend setting a management profile that strictly limits the amount of IP addresses that can actually manage this device. That way you can not only be secure in knowing that nobody can just login to your device but they won't even see the login page or get access to the devices management if they don't have the set IP addresses.