SSH2 Brute Force events in System Logs

Reply
L1 Bithead

SSH2 Brute Force events in System Logs

Hi guys,

I've noticed in my System logs that there are SSH2 brute force attempts against our firewall.

Unfortunately nothing is listed in the Traffic or Threat logs under the Monitor tab to indicate from which zone the traffic is originating from.

Why would this be the case and how can I enable logging for this in the Traffic\Threat logs to determine from which zones the traffic is originating from?

Community Manager

Re: SSH2 Brute Force events in System Logs

Hi @TheRedBar0n

 

isn't there a 'from: <IP>' included in the log?

a good start would be to check incoming ssh sessions from the internet (as this is usually the most likely source)

 

if these are hitting your management, i would recommend removing access to your management interface from outside or at least configuring some security policy to only allow trusted sources to connect


Help the community: Like helpful comments and mark solutions
Reaper out
L1 Bithead

Re: SSH2 Brute Force events in System Logs

Hi Reaper,

 

Yes there are IP's included in the System logs. I have checked my traffic logs, and the only SSH sessions are those internally outbound that we have explicitly allowed. We have recently further hardended all our public IP's, so no SSH sessions should be hitting my firewall.

 

How am I able to determine whether the SSH logon attempts is hitting my management IP?

Community Manager

Re: SSH2 Brute Force events in System Logs

If there is an IP, that should probably give you an indication where the connection is coming from, but if there's nothing in your traffic logs they may be hitting a management profile on a dataplane interface (rather than the management interface):

 

mgmt profile.png

 

 


Help the community: Like helpful comments and mark solutions
Reaper out
L1 Bithead

Re: SSH2 Brute Force events in System Logs

Thanks Reaper,

 

I see we previously configured 3 different management profiles.

 

Am I correct in saying that if there is no IPs listed in the Permitted IP Addresses, this will allow the selected services from any source IP?

Community Manager

Re: SSH2 Brute Force events in System Logs

That is correct

Help the community: Like helpful comments and mark solutions
Reaper out
L1 Bithead

Re: SSH2 Brute Force events in System Logs

Thank you Reaper, I have adjusted our management profiles and will be monitoring the system logs over the next few days. Appreciate the assistance!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!