Technical Tip: How to secure and limit an SSL VPN unknown user login (Brute force attack)
| Description | This article describes how to process a brute force attack on SSL VPN login attempts with random users/unknown users and how to protect from SSL VPN brute-force logins. The attacker is trying to use a dynamic IP address and a random admin user account to log in via SSL VPN. |
| Scope | FortiGate. |
|
Solution | In this situation, process as follows:
This includes password rules like in this example:
Two-factor authentication prevents an attacker from being able to log in to an account only with a username and password. With the third factor, the attacker needs access to additional information like the smartphone (in case of push token) or a 6-digit number (in case of mobile or hardware Tokens).
Related documents: Set up FortiToken two-factor authentication Technical Tip: Email Two-Factor Authentication on FortiGate
3. Ensure that admin users have no access to the SSL VPN portal. It is recommended to differentiate user accounts that are allowed to access VPN solutions and administrative accounts that are only allowed to access the administrative interfaces.
4. Change the listening Port for the SSL VPN portal. Using another port is an easy but effective measure if an attacker is only probing the default port of an application. Do not forget to change the port on all VPN clients, too. Otherwise, the connection will break.
Related document: Configuring the SSL VPN tunnel
There is a KB article regarding the implementation of a login limit for SSL-VPN: Technical Tip: How to limit SSL VPN login attempts and block duration.
6. Restrict the source IP address area. If users only need access to the SSL-VPN portal from a specific source address or range, it is possible to limit the allowed source addresses to those addresses and also restrict users based on country or geographic address. From v7.4.4+, there is an option to use Internet Service Database in a local-in policy to block traffic from known malicious sources, such as botnet infrastructure, phishing hosts, anonymous VPN providers, proxy services, Tor nodes, and bulletproof hosting providers. Technical Tip: Local-in policy using ISDB as a source address.
7. Disable Web Mode: If there is no use for the web portal, it is recommended to disable it and add a blank replacement message: Technical Tip: How to create a blank page for SSL VPN Portal with replacement messages. Filter by action="ssl-login-fail" tunneltype="ssl-web" Log & Report -> System Events -> VPN Events.
8. If there are no requirements for a specific authentication mechanism, such as LDAP/Radius/Local authentication, do not include these users/groups within SSLVPN settings, as it prevents servers from being contacted.
9. Use a custom web portal with web mode and tunnel mode disabled for the default portal.
10. To prevent attempts to lock out the user account on the remote authentication server, use the SSL VPN realm. Refer to the following article:
Note: Creating an authentication rule or local-in policy to restrict SSL VPN connections will help to reduce the login and failed attempts seen under Log & Reports -> System Events -> VPN events.
Related articles: |
