RE: Netscreen 5XT SSH Traffic

From: Dante Mercurio (Dante_at_webcti.com)
Date: 03/18/05

  • Next message: Michael Peppard: "Re: Netscreen 5XT SSH Traffic" 
    Date: Fri, 18 Mar 2005 14:38:47 -0500
To: <jnichols@pbp.net>, "Ben Blakely" <blakely@krellinst.org>

    I can't tell from your email what indications you currently have that
    this came through the firewall and was not spoofed from the inside in
    some manner. I've always found the Netscreen to be a pretty secure
    device and this would be a serious flaw.

    Are there any other methods onto the network such as dial-in, VPN, or
    vendor connections? Attacks can originate from any of these without a
    flaw in the firewall software.

    M. Dante Mercurio, CISSP, CWNA, Security+, SCSP

    -----Original Message-----
    From: Jonathan Nichols [mailto:jnichols@pbp.net]
    Sent: Friday, March 18, 2005 12:33 PM
    To: Ben Blakely
    Cc: incidents@securityfocus.org
    Subject: Re: Netscreen 5XT SSH Traffic

    Ben Blakely wrote:
    > Hello List,
    >
    > I'm the admin for a small network that uses a NetScreen 5XT firewall
    as
    > the border access control device. Just like everyone else, we get a
    > pretty constant stream of SSH login attempts to our full range of IPs.
    > This doesn't concern us too much as our root logins are disabled and
    we
    > enforce strong passwords. However, several days ago we started seeing

    > SSH (v2, port 22) login attempts to machines that the firewall should
    > not be allowing SSH traffic to in the first place. Unfortunately this

    > happened overnight and our log vault machine was experiencing
    unrelated
    > problems. Due to this I wasn't able to capture any of the traffic for
    > closer dissection. The only conclusion we were able to reach here was

    > that perhaps there is a state table poisoning bug in the NetScreen
    code
    > that tricked the firewall into thinking the traffic had originated as
    > egress. Is this a reasonable conclusion? To be honest that seems
    like
    > a bit of a reach, does anyone else have any experience with similar
    > incidents or any possible explanations? I'll happy to clarify
    anything
    > I can with the data I have, thanks for your time everyone.
    >
    > /ben Blakely

    Have you contacted Netscreen/Juniper TAC about this? There are ways to
    capture packets on the 5XT itself for analysis. Do you have another host

    that you can use to test this from the outside? If it's an internal box
    that shouldn't be allowed SSH access, you oughta be able to test that
    from a machine outside the network.

    I'd definitely contact the TAC about this, and have them review the
    firewall rules as well. It's possible that there's a rule that's
    overriding your deny SSH rule.

  • Next message: Michael Peppard: "Re: Netscreen 5XT SSH Traffic"

    Relevant Pages

    • Re: Questions on some wierd /var/log entries
      ... How do I find out if I'm on an ipv6 network? ... That is because I prefer using iptables directly. ... then you should start learning about its firewall ... Another important restriction for ssh is to authenticate by certificate ...
      (comp.os.linux.misc)
    • Re: Unique ssh/sftp requirement
      ... The network layer (where the firewall works) sees no difference in the content ... of an ssh connection vs. an scp/sftp connection. ... > Preferably at the server end, ...
      (SSH)
    • Re: Netscreen 5XT SSH Traffic
      ... > I'm the admin for a small network that uses a NetScreen 5XT firewall as ... > the border access control device. ... > pretty constant stream of SSH login attempts to our full range of IPs. ... Have you contacted Netscreen/Juniper TAC about this? ...
      (Incidents)
    • Re: NAS Server
      ... is the only *nix system in the net then you don't need ftp, telnet or ... ssh. ... the firewall, you didn't state whether the SuSE server is also the ... If your network has other *nix systems and you want/need to serve files ...
      (alt.os.linux.suse)
    • Re: [fw-wiz] Is NAT in OpenBSD PF UPnP enabled or Non UPnP?
      ... >> I start by not giving logins and SSH access to users I don't trust. ... a network topology which goes around the ... >> firewall and thus is a serious hole to network security. ... >> have access via UPnP to, well, anything that device might happen to ...
      (Firewall-Wizards)