topic Re: How to block TCP22 connections in General Topics

How to block TCP22 connections

SOC_CSG — Fri, 17 Mar 2017 09:03:45 GMT

Hi everybody

I like to know if there is a way to block incoming connections attemps to port TCP 22.

I have an end-customer which has lots of connections to his public ip range 0.0.0.0/24 to port TCP22 but not hit the vulnerability 40015 (SSH User Authentication Brute-force Attempt) because it neves triggers the child signature 31914 (SSH2 Login Attempt) because there no attempt to connect, it just an scanning.

I'm loooking at DoS Protection, which may works, but I'm not sure what to do in Option/Protection tab. I think I need to configure at Classified option a DoSProteccion Profile, but I'm lost, I donp't know it is better user FloodProtections or Resources Protection.

Do anybody has resolved this issue?

Re: How to block TCP22 connections

santonic — Fri, 17 Mar 2017 10:24:59 GMT

First use firewall rules to only allow traffic from internet to IPs and services which need to be visible from all internet.

If you need to have TCP 22 (SSH?) open from internet, make sure that it's only from specific sources (if possible).

Once you've closed all not needed ports from internet take a look at:

- IPS profile to detect and block multiple login atempts (brute force) to a server which actually listens on that port,

- Zone Protection (with both Flood and Reconnaissance protection) to protect server and obscure results for scans

Re: How to block TCP22 connections

bradk14 — Fri, 17 Mar 2017 17:45:55 GMT

by default, it should be blocked already. if the logs are showing allowed (safe to assume they're SYN timeouts?), you must have a policy permitting it I imagine.

Re: How to block TCP22 connections

santonic — Wed, 22 Mar 2017 08:12:47 GMT

SYN cookie doesn't change log entry to 'allow'. PA replies with SYN ACK but log entry remains 'drop' if the port isn't open.

Re: How to block TCP22 connections

reaper — Tue, 21 Mar 2017 12:55:33 GMT

depending on what you're seeing exactly you could either create a drop policy or use zone protection's reconnaissance protection: