topic Re: Want to allow SFTP only and not SSH Traffic in General Topics

Want to allow SFTP only and not SSH Traffic

SahulH — Wed, 29 Jan 2020 11:19:39 GMT

Hi Team,

I am trying to achieve my requirement however, unable to achieve it. Please review my requirement below and suggest your thoughts if there are any possible way to accomplish.

I want to block SSH traffic and at the same time i need to allow SFTP traffic for our users. I have referred to some KB Article and that states in order to allow the SFTP traffic we need to allow SSH application. So if in this case Normal SSH Traffic also will get allowed. So please share your thoughts for the same.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHtCAK

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOPCA0

Also i can see that, there is a feature request for creating a separate App ID for SFTP (Link Mentioned below). Can i know the status on that as well.

https://live.paloaltonetworks.com/t5/General-Topics/How-to-restrict-FTP-and-SFTP-access-using-a-security-policy/m-p/6617#M4837

Awaiting for your response !!

Best Regards,

Sahul Hameed

Re: Want to allow SFTP only and not SSH Traffic

kiwi — Wed, 29 Jan 2020 11:35:41 GMT

Hi @SahulH ,

Yes there is indeed an open feature request for this (to differentiate SFTP from SSH in APP-ID).

Please reach out to your local SE and have him add your vote to the FR:

FR ID: 2555

Cheers,

-Kiwi.

Re: Want to allow SFTP only and not SSH Traffic

SahulH — Wed, 29 Jan 2020 11:42:21 GMT

Hi @kiwi ,

Thanks for your response on my query, Also i want to know is there of any way to accomplish the necessary requirement in our Current scenario without having a separate App ID for SFTP. To block SSH and allow only SFTP traffic. Do let us know on this as well.

Thanks in advance !!

Best Regards,

Sahul Hameed

Re: Want to allow SFTP only and not SSH Traffic

RobinClayton — Wed, 29 Jan 2020 14:56:52 GMT

Since SFTP is just FTP over SSH, it implicitly is just SSH. So without deeper inspection of the packets by the AppID enigne there is no way to a SSH terminal over SFTP.

Re: Want to allow SFTP only and not SSH Traffic

OtakarKlier — Wed, 29 Jan 2020 16:20:43 GMT

Hello,

How about a whitelist that allows your users to only sites that are approved?

Just a thought.

Re: Want to allow SFTP only and not SSH Traffic

jeremy.larsen — Thu, 30 Jan 2020 14:51:59 GMT

Agreed! SFTP is just an FTP feature traversing over SSH. They are essentially the same protocol. You would have to have some crazy man-in-the-middle encrypt/decrypt to even attempt this. This sounds a lot like security engineer over-reach or misunderstanding of protocols.