Netscreen 5XT SSH Traffic

From: Ben Blakely (blakely_at_krellinst.org)
Date: 03/18/05

  • Next message: Jeff Kell: "Re: Pubstro rash" 
    Date: Fri, 18 Mar 2005 09:49:11 -0600
To: incidents@securityfocus.org

    Hello List,

      I'm the admin for a small network that uses a NetScreen 5XT firewall
    as the border access control device. Just like everyone else, we get a
    pretty constant stream of SSH login attempts to our full range of IPs.
    This doesn't concern us too much as our root logins are disabled and we
    enforce strong passwords. However, several days ago we started seeing
    SSH (v2, port 22) login attempts to machines that the firewall should
    not be allowing SSH traffic to in the first place. Unfortunately this
    happened overnight and our log vault machine was experiencing unrelated
    problems. Due to this I wasn't able to capture any of the traffic for
    closer dissection. The only conclusion we were able to reach here was
    that perhaps there is a state table poisoning bug in the NetScreen code
    that tricked the firewall into thinking the traffic had originated as
    egress. Is this a reasonable conclusion? To be honest that seems like
    a bit of a reach, does anyone else have any experience with similar
    incidents or any possible explanations? I'll happy to clarify anything
    I can with the data I have, thanks for your time everyone.

    /ben Blakely

  • Next message: Jeff Kell: "Re: Pubstro rash"

    Relevant Pages

    • SCP/SFTP Passthrough Solution?
      ... We have a firewall setup that currently only allows incoming SSH. ... We then login and can SSH to 10 machines. ... The users have their own login on the firewall, ...
      (comp.security.ssh)
    • Re: Openvpn Fedora tutorial?
      ... I don't seem able to ssh in either direction. ... And ping fails in both directions too. ... I found the problem did indeed lie in the firewall. ... Last login: Thu Jan 3 11:24:28 2008 from ...
      (Fedora)
    • Re: [fw-wiz] Is NAT in OpenBSD PF UPnP enabled or Non UPnP?
      ... >> I start by not giving logins and SSH access to users I don't trust. ... a network topology which goes around the ... >> firewall and thus is a serious hole to network security. ... >> have access via UPnP to, well, anything that device might happen to ...
      (Firewall-Wizards)
    • Re: ssh attempts
      ... the excellent iptables firewall you probably already have on your system. ... consider changing the port SSH listens on. ... Login to account webmaster not allowed or account non-existent. ... Computer Emergency Response Teams, and Digital Investigations. ...
      (Security-Basics)
    • Re: mpich and iptables firewall?
      ... to me it seems a very weird setup to have a firewall running ... on the cluster nodes. ... Using SGE you could disable rsh and ssh completely ... Chain FORWARD ...
      (comp.parallel.mpi)