topic SSH2 Brute Force events in System Logs in General Topics

SSH2 Brute Force events in System Logs

TheRedBar0n — Thu, 30 Nov 2017 13:11:24 GMT

Hi guys,

I've noticed in my System logs that there are SSH2 brute force attempts against our firewall.

Unfortunately nothing is listed in the Traffic or Threat logs under the Monitor tab to indicate from which zone the traffic is originating from.

Why would this be the case and how can I enable logging for this in the Traffic\Threat logs to determine from which zones the traffic is originating from?

Re: SSH2 Brute Force events in System Logs

reaper — Thu, 30 Nov 2017 13:48:10 GMT

Hi @TheRedBar0n

isn't there a 'from: <IP>' included in the log?

a good start would be to check incoming ssh sessions from the internet (as this is usually the most likely source)

if these are hitting your management, i would recommend removing access to your management interface from outside or at least configuring some security policy to only allow trusted sources to connect

Re: SSH2 Brute Force events in System Logs

TheRedBar0n — Mon, 18 Dec 2017 12:39:12 GMT

Hi Reaper,

Yes there are IP's included in the System logs. I have checked my traffic logs, and the only SSH sessions are those internally outbound that we have explicitly allowed. We have recently further hardended all our public IP's, so no SSH sessions should be hitting my firewall.

How am I able to determine whether the SSH logon attempts is hitting my management IP?

Re: SSH2 Brute Force events in System Logs

reaper — Mon, 18 Dec 2017 12:59:44 GMT

If there is an IP, that should probably give you an indication where the connection is coming from, but if there's nothing in your traffic logs they may be hitting a management profile on a dataplane interface (rather than the management interface):

Re: SSH2 Brute Force events in System Logs

TheRedBar0n — Mon, 18 Dec 2017 13:18:59 GMT

Thanks Reaper,

I see we previously configured 3 different management profiles.

Am I correct in saying that if there is no IPs listed in the Permitted IP Addresses, this will allow the selected services from any source IP?

Re: SSH2 Brute Force events in System Logs

reaper — Mon, 18 Dec 2017 13:53:17 GMT

That is correct

Re: SSH2 Brute Force events in System Logs

TheRedBar0n — Tue, 19 Dec 2017 08:49:06 GMT

Thank you Reaper, I have adjusted our management profiles and will be monitoring the system logs over the next few days. Appreciate the assistance!