topic Re: Application 'github-base' and SSH in General Topics

Application 'github-base' and SSH

RSKadish — Tue, 15 Dec 2015 19:32:01 GMT

Hi all,

Can someone please explain why the "github-base" application depends on SSH?

We are running into a number of problems with web sites that are hosted on Github. Users want to get to these sites for legitimate reasons. IT people have also wanted to download Github projects. I don't have a problem with approving github-base, but we have no desire to approve SSH.

Any help or advice is appreciated.

TIA,

- Steve

Re: Application 'github-base' and SSH

OtakarKlier — Tue, 15 Dec 2015 23:55:10 GMT

So I could be wrong on this, however scp also uses port 22 and is identified by the PAN as SSH traffic. Not sure if github uses scp, however if it doesn then this could be the reason why. You could further lock down the policy for github to certain sites only?

Cheers!

Re: Application 'github-base' and SSH

cpainchaud — Wed, 16 Dec 2015 11:41:39 GMT

unless Github provides a list of their public IPs and you limit your rule to them, then you will have to allow SSH globally unfortunatly.

Doesn't Github have a SSL/HTTP fallback method ?

Re: Application 'github-base' and SSH

BenjAudy.MTL — Wed, 16 Dec 2015 15:29:34 GMT

Hi,

This webpage lists the current IP address range used, so you could restrict SSH to this range:

https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/

Regards,

Benjamin

Re: Application 'github-base' and SSH

RSKadish — Wed, 16 Dec 2015 15:53:05 GMT

Hi all,

Thanks for the replies. This is one of the websites that our PAs are blocking:

http://www.whatsmyua.com/

Note that this page isn't on GitHub itself. The source code for the project is on GitHub. Looking at the page's source, I see two links to GitHub - the "Source" link at the top and the "send and issue or pull request" link at the bottom. Both of these links use the HTML tag

My HTML is pretty rusty, because I thought that <i> was for italics.

So I'm back to the original question, why do we need ssh enabled to use this site? For that matter, should we need the github-base app-ID enabled at all?

Thanks,

- Steve

Re: Application 'github-base' and SSH

BenjAudy.MTL — Wed, 16 Dec 2015 22:10:42 GMT

Hi,

You don't need to allow SSH just to browse the website, but you will probably get a warning every time you commit some changes on the firewall (which you can ignore in your case). Even if you fork the repository, it will work as long as you use git with HTTPS and not SSH. The website seems to be hosted by Github, hence the github-base app for that traffic.

Regards,

Benjamin

Re: Application 'github-base' and SSH

RSKadish — Mon, 04 Jan 2016 20:33:50 GMT

Hi Benjamin,

Thanks for the info; I wanted to wait until our primary firewall admin got back from vacation to discuss it with him. We agree that we could enable github-base without SSH and put up with the errors. However I disagree that the traffic application should be "github-base" in the first place since this is basically a straight HTTP site. We are going to open a ticket with PA tech support about that.

Thanks,

- Steve

Re: Application 'github-base' and SSH

fwmike — Wed, 18 Sep 2019 19:46:10 GMT

https://live.paloaltonetworks.com/t5/MineMeld-Discussions/New-GitHub-Miner/td-p/229904

Haven't tried it yet but looks like a reasonable solution for restricting SSH to GitHub destinations.