SSH2 Brute Force events in System Logs

[TheRedBar0n]

Hi guys,

I've noticed in my System logs that there are SSH2 brute force attempts against our firewall.

Unfortunately nothing is listed in the Traffic or Threat logs under the Monitor tab to indicate from which zone the traffic is originating from.

Why would this be the case and how can I enable logging for this in the Traffic\Threat logs to determine from which zones the traffic is originating from?

[reaper]

Hi @TheRedBar0n

isn't there a 'from: <IP>' included in the log?

a good start would be to check incoming ssh sessions from the internet (as this is usually the most likely source)

if these are hitting your management, i would recommend removing access to your management interface from outside or at least configuring some security policy to only allow trusted sources to connect

[TheRedBar0n]

Hi Reaper,

Yes there are IP's included in the System logs. I have checked my traffic logs, and the only SSH sessions are those internally outbound that we have explicitly allowed. We have recently further hardended all our public IP's, so no SSH sessions should be hitting my firewall.

How am I able to determine whether the SSH logon attempts is hitting my management IP?

[reaper · Accepted solution]

If there is an IP, that should probably give you an indication where the connection is coming from, but if there's nothing in your traffic logs they may be hitting a management profile on a dataplane interface (rather than the management interface):

[TheRedBar0n]

Thanks Reaper,

I see we previously configured 3 different management profiles.

Am I correct in saying that if there is no IPs listed in the Permitted IP Addresses, this will allow the selected services from any source IP?

[reaper]

That is correct

[TheRedBar0n]

Thank you Reaper, I have adjusted our management profiles and will be monitoring the system logs over the next few days. Appreciate the assistance!