How to Shutdown " User authentication for policy override"

TopJimmy · ‎07-22-2009

I' ve got a weird situation that I hope somebody can help me with. For some reason when scanning a target on our network for vulnerabilities (using the analyzer or a nessus host), my FortiGate 800 cluster responds for the target on port 8008 so it looks like the target host has some service running on port 8008. I' m scanning from the internet network to a host in the DMZ. Here is the source that it responds with:

<head> <title>Web Filter Block Override</title> </head> <body> <div style=" text-align: center;" ><img src=" http://xxx.xxx.xxx.xxx/logo1.gif" ><img src=" http://xxx.xxx.xxx.xxx/logo2.jpg" > </div> <font size=" 2" > <table style=" width: 100%;" > <tbody> <tr> <td colspan=" 2" style=" text-align: center; background-color: rgb(35, 83, 147);" ><font color=" #ffffff" ><b>Web Filter Block Override</b></font></td> </tr> <tr> <td colspan=" 2" ><br> <br> You have been granted override privileges for this website due to your job function. You can enter your username and password here to gain immediate access to the blocked web-page.<br> <br> </td> </tr> <tr> <td colspan=" 2" align=" center" ><font color=" #FF0000" >Invalid or missing protection profile ID in request.</font></td> </tr> </tbody> </table> <br> <hr><br> </font> </body> </html>^M

According to Traffic Types and TCP/UDP Ports used by Fortinet Products port 8008 is used for " authentication for policy override of HTTP traffic" . Since I don' t allow overrides, I' m wondering how to get it to close that port.

-TJ

abelio · ‎07-22-2009

Easier: use CLI to edit global setting and move that port to another unused one. (config system global , etc)

regards

/ Abel

rwpatterson · ‎07-22-2009

Wouldn' t it still show up in a port scan?

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

abelio · ‎07-23-2009

Yes at first. I believe that Topjimmy just wanted to solve his issue not closing ports. anyway, my first post was wrong; the CLI sequence to modify webfilter override for http might be: config webfilter fortiguard set ovrd-auth-port-http <newportnumber> end

regards

/ Abel

TopJimmy · ‎07-23-2009

I' d like to close the port all together since I don' t allow policy overrides. Regardless, I made the change (port 9999) and am re-running the scan to see if it shows up on that port.

-TJ