Unauthorized user attempt

[kinmun]

i noticed that there are quite a number of unauthorize user trying to gain access to my firewall.

other than removing ssh n https access, is there anything else i can do ?

[sym]

HA wrote:

First, I create an admin profile with NONE privilege.

Next, a create a user 'called it PING' with the NONE profile and NO IP restriction (to allow ping from everywhere).

Next, I limit the admin user to specific IP Range.

The external user can still try to connect but even if they discover the PING password, no privilege will be granted...

I tried that route as well, but I never want everyone to have an open port accessible. In this case, i would completely rely on the security functions of the device. What if the account login functionality got a flaw?

[nothingel]

HA wrote:

I personally used the following method.

First, I create an admin profile with NONE privilege.

Next, a create a user 'called it PING' with the NONE profile and NO IP restriction (to allow ping from everywhere).

Next, I limit the admin user to specific IP Range.

The external user can still try to connect but even if they discover the PING password, no privilege will be granted...

I am essentially doing the same thing.  I have a user with no access and a very long password with no IP restrictions.  This will allow PING to work.

But, I grew tired of changing my other admin ports like HTTPS and SSH to something else.  Even when I did change them, I still had people discover them and try daily to login (didn't happen at all sites though).  I then decided to switch back to standard port numbers but use local-in policies to totally block all access to sensitive ports like HTTPS and SSH from everywhere except trusted IPs.  PING still works because of the extremely limited user account and no special rules were needed in the local-in policies.

Like I said at one point, Fortinet should make it much easier to control PING separately from the other administrative services.

[emnoc]

I take the same approach as   HA but use a password characters of 20+ and with two-form authentication than allow that guys un-trust access.

For basic admin access do like he stated, create a "NONE" profile ( he mention priv but is a profile with nothing allow ) and apply that to the ping user.

Ken

[emnoc]

Valid points you have to analyze the risk. If you create a weird username and with a max password characters and then enable  two-factor, your risk of exposure is minimal.

1st they person has to KNOW the account to enter any next step

2nd they would need to know your long passsword

3rd they would need to know the token

That's alot of information the attacker could never acquire. In my case for the token I sent it to a nobody account.

e.g

nobody@nosuchdomain.com

So when they are challenged &  if they managed to find steps #1 and #2 ( very highly unlikely btw ) they would never have the token since they are unaware of what the token is.

It's like 110% fool-proof imho and allow you have a ping service for whoever need to ping you. Sinec I've used this approach that HA has mention and changing the ssh to port xx22 all of my unauthorized logins ssh  has been eliminate and I never had a  failed web login.

And as what HA mention if they could get thru steps #1 #2 #3 , they have "NONE" privilege to do anything. Once again, this is like 10000000% fool-proof.