SSH login: How to block interactive-password but allow certificate-based login ?

Forum|Forum|2 years ago
December 27, 2023
2 replies
1199 views

Has anybody implemented this on a FortiGate i.e. based on https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-SSH-but-allow-SFTP-using-the-same-TCP/ta-p/199640 ?

FortiGate

dbu

Staff

Hi @Anonymous_User ,
Are you facing an issue trying to implement this solution ?
I have not done it myself but i can help you troubleshoot it.

ebilcari

Staff

I guess that your requirement is not the same with the article you mentioned. It will differentiate between two different protocols sharing the same port. In your case you are trying to differentiate on the authentication type used for SSH. I can't think of a way for FGT to block this, the easiest way could be limiting it from the server side.

Emirjon

ebilcari

Staff

Theoretically this can be achieved using custom IPS signature. If it's possible to build a custom pattern that is seen only during the SSH session when credentials are used, than chose to drop that traffic. I don't have experience with this but this article or this guide may help.

Emirjon

Sign up

Login with SSO

Login to the community

Login with SSO