Contributor

Question

Someone trying to hack my firewall !!

Forum|Forum|15 years ago
December 15, 2010
10 replies
10406 views

Hello, Everyday I got these error but I wonder if really anyone trying to hack my firewall , if it is real please help me to secure my fortigate 36 2010-12-15 07:50:09 alert admin 41985 200.201.180.130 login Login disabled from IP 200.201.180.130 for 60 seconds because of too many bad attempts 37 2010-12-15 07:50:09 alert admin 41985 ssh(200.201.180.130) login Administrator payala login failed from ssh(200.201.180.130) because of invalid user name 38 2010-12-15 07:50:06 alert admin 41985 ssh(200.201.180.130) login Administrator root login failed from ssh(200.201.180.130) because of invalid user name 39 2010-12-15 07:50:03 alert admin 41985 ssh(200.201.180.130) login Administrator eaguilar login failed from ssh(200.201.180.130) because of invalid user name 40 2010-12-14 20:28:57 alert admin 41985 210.66.168.73 login Login disabled from IP 210.66.168.73 for 60 seconds because of too many bad attempts 41 2010-12-14 20:28:57 alert admin 41985 ssh(210.66.168.73) login Administrator root login failed from ssh(210.66.168.73) because of invalid user name 42 2010-12-14 20:28:54 alert admin 41985 ssh(210.66.168.73) login Administrator root login failed from ssh(210.66.168.73) because of invalid user name 43 2010-12-14 20:28:51 alert admin 41985 ssh(210.66.168.73) login Administrator root login failed from ssh(210.66.168.73) because of invalid user name 44 2010-12-14 19:45:07 alert admin 41985 60.50.24.134 login Login disabled from IP 60.50.24.134 for 60 seconds because of too many bad attempts 45 2010-12-14 19:45:07 alert admin 41985 ssh(60.50.24.134) login Administrator root login failed from ssh(60.50.24.134) because of invalid user name 46 2010-12-14 19:45:07 alert admin 41985 ssh(60.50.24.134) login Administrator root login failed from ssh(60.50.24.134) because of invalid user name 47 2010-12-14 19:45:07 alert admin 41985 ssh(60.50.24.134) login Administrator root login failed from ssh(60.50.24.134) because of invalid user name

abelio

SuperUser

Indeed, it could be just a script kiddie trying to remote access your unit. . Do you need really external SSH admin access? . Use trusted-hosts for administrative admin account . a lot of good practices about this are available regards,

A

Anonymous_UserAuthor

Contributor

Two more things you need to do for each device: 1) Change super_admin name. Make it something non-standard for an admin account like: Phineas, Gandalf, or Toothless... well you get the idea. 2) Change the port numbers for your admin ports. Instead of 22 for ssh, use 22342 or something like that. Don' t forget to change the HTTPS port while you are at it. Hope that helps.

abelio

SuperUser

2) Change the port numbers for your admin ports. Instead of 22 for ssh, use 22342 or something like that.

well, it could be useful although but it could be security by oscurity, a very short term approach. It' s useful for scriptkiddies and mantaing more cleaner your events logs, but nothing that a one minute nmap scan couldn' t reveal... regards

ede_pfau

SuperUser

...but then again, most of the automated attacks just try the standard ports. Unfortunately, you cannot use IPS to protect the admin access to the FG itself (or can you??). After changing the admin port to the high end the number of login attempts has dropped on all FGs that I administer by 99%.

emnoc

New Member

After changing the admin port to the high end the number of login attempts has dropped on all FGs that I administer by 99%.

same here, I run 2022 for all external admin interfaces. Works like a charm and reduce or in my case, eliminates all ssh/login failures. I wish ciscoASA would allow for something like this

A

Anonymous_UserAuthor

Contributor

Thanks all ,Sorry but what is meaning by SSH access ? and how can I disable it ? about the ports, which port I have to change ? Web Administration Ports HTTP: 80 HTTPS:443 SSLVPN Login : 10443 Telnet : 23 SSH :22 I understood that I have to change SSH port to something like 5124 than I login to the device by this https//:ip:5124 Am I right ?

ede_pfau

SuperUser

OK, first things first. You enable administrative access to the firewall in Network>Interface>interface_name for whatever interface you want to use to manage your firewall. I do not recommend to do this on wan/wan1 interface like you do now. I you want to manage the firewall from remote, create a dial-in VPN to the internal LAN, and enable admin access on ' internal' . You need HTTPS (for browser), SSH (for command line) and PING (for troubleshooting). HTTP and TELNET not recommended because the password is transmitted in cleartext. SNMP if you need it. Then, in System>Admin>Settings, change the default ports for HTTPS at least. SSH if used. For SSH command line you need a terminal client software, such as WinSSH. It does not work with a browser. SSH is an encrypted protocol for terminal access. HTTPS access would then be https://myFortigate:51443 i.e. if you don' t use the default port 443 then you have to specify it with the web address. Again, you CAN do that with the wan interface. I wouldn' t do it. But for the VPN method, you must be sure that VPN will work, or you won' t get in.

A

Anonymous_UserAuthor

Contributor

thank ede_pfau so much for your helpful post, I' ll disable SSH in internal & WAN cause I didn' t use it , just configure the firewall using web browser. I changed the HTTPS port to 51443 but I still connect normally without specify the port number , I noticed that I connect using HTTP not HTTPS HTTP:\\fortigateip

ede_pfau

SuperUser

...then you have enabled it in the interface settings! Disable that asap.

A

Anonymous_UserAuthor

Contributor

you are the man , thank you so much ede_pfau :)

ede_pfau

SuperUser

you' re welcome! Glad you are getting forward.

g3rman

New Member

Also check out this post on locking down administrative services without changing port numbers: http://firewallguru.blogspot.com/2009/02/securing-firewall-administrator-access.html

mario_veiga

New Member

Besides changing admin ports from ssh 22 and https 443 try this if you have and available public ip.

Create a new interface on your firewall making it a loopback interface. Use a private ip /32 host. Example 172.16.1.1/32 or 192.168.1.1. Allow https and ssh access on this loop back interface. Now creat a VIP pointing to the loop back ip using a public ip. Example 123.234.245.267 nat to loopback ip you used. Now you can create a firewall policy allowing Outside/Wan to this VIP on https ssh or whatever ports you need. But now you can specify a source. You can even use a GEO ip to only allow inbound access to your firewall from a certain country. Create a deny policy below this to log attempted logins. Test access using new public ip before disabling https and ssh on your current outside wan interface.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded