Due to Open SSH Denial of Service vulnerability firewall dropping random connections

[gasin1]

Hi Guys,

Large number of connection attempts made which is normal as per the server team but firewall is considering it vulnerability and dropping the random connection to the server. After getting 3 to 4 successful execution in the same session it getting failed.

error msg :

org.apache.commons.vfs2.FileSystemException: Could not connect to SFTP server at "ft.centiro.ikea.cn".

                at org.apache.commons.vfs2.provider.sftp.SftpClientFactory.createConnection(SftpClientFactory.java:230)

                at com.sunopsis.dwg.tools.filecopy.RemoteFileCopy.copy(RemoteFileCopy.java:502)

Please help me understand how it can be rectified

[reaper · Accepted solution]

what are you seeing on the firewall? is the ssh denial of service being triggered for each time the execution fails? 

If that's the case then creating an exception (click the little arrow next to the threat name in the threat log) for the involved IP addresses and your issue should be fixed

[Abdul-Fattah · Accepted solution]

Hi,

well if i understand what you wrote correctly, then that depends on your security Profile on the Firewall, you can make a seperate security rule for that server with a valunrability profile with an exception for that signature that causing the problem

[reaper · Accepted solution]

you don't need to create a new rule with a new security profile. you can add an exception to the existing proile, and limit the exception to a specific IP address so it only applies to these connections (and keeps protecting everything else)