Due to Open SSH Denial of Service vulnerability firewall dropping random connections
cancel
Showing results for 
Search instead for 
Did you mean: 

Due to Open SSH Denial of Service vulnerability firewall dropping random connections

L1 Bithead

Hi Guys,

 

Large number of connection attempts made which is normal as per the server team but firewall is considering it vulnerability and dropping the random connection to the server. After getting 3 to 4 successful execution in the same session it getting failed.

 

error msg :

org.apache.commons.vfs2.FileSystemException: Could not connect to SFTP server at "ft.centiro.ikea.cn".

                at org.apache.commons.vfs2.provider.sftp.SftpClientFactory.createConnection(SftpClientFactory.java:230)

                at com.sunopsis.dwg.tools.filecopy.RemoteFileCopy.copy(RemoteFileCopy.java:502)

Please help me understand how it can be rectified

 

3 ACCEPTED SOLUTIONS

Accepted Solutions

L7 Applicator

what are you seeing on the firewall? is the ssh denial of service being triggered for each time the execution fails? 

 

If that's the case then creating an exception (click the little arrow next to the threat name in the threat log) for the involved IP addresses and your issue should be fixed

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374

View solution in original post

L4 Transporter

Hi,

 

well if i understand what you wrote correctly, then that depends on your security Profile on the Firewall, you can make a seperate security rule for that server with a valunrability profile with an exception for that signature that causing the problem

 

 

View solution in original post

you don't need to create a new rule with a new security profile. you can add an exception to the existing proile, and limit the exception to a specific IP address so it only applies to these connections (and keeps protecting everything else)

 

2021-03-25_12-11-24.png

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374

View solution in original post

3 REPLIES 3

L7 Applicator

what are you seeing on the firewall? is the ssh denial of service being triggered for each time the execution fails? 

 

If that's the case then creating an exception (click the little arrow next to the threat name in the threat log) for the involved IP addresses and your issue should be fixed

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374

View solution in original post

L4 Transporter

Hi,

 

well if i understand what you wrote correctly, then that depends on your security Profile on the Firewall, you can make a seperate security rule for that server with a valunrability profile with an exception for that signature that causing the problem

 

 

View solution in original post

you don't need to create a new rule with a new security profile. you can add an exception to the existing proile, and limit the exception to a specific IP address so it only applies to these connections (and keeps protecting everything else)

 

2021-03-25_12-11-24.png

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!