FEATURE REQUEST: SSH password guessing handling

Follow

Daniel Megson

• January 15, 2022 07:14

Please create a workflow that allow 'block IP addresses from all SSH Password Guessing alarms except xxxxxxxxxxx' where xxxxxxxxxx can be a specified IP address, country, or provider.

4

• 

  Angel Wash

  • January 12, 2023 01:17

  I would like to request the same feature. How can we block SSH access to Firewalla Gold from specific network segment or specific devices?

   

   

  1

  Comment actions Permalink
• 

  Firewalla

  • January 12, 2023 04:53

  First, ssh password guessing can also be people typing in the wrong password ... Anyway, the best way to resolve this is not expose SSH directly to the internet and use VPN.

  You can turn off firewalla SSH settings->advanced->configurations->ssh

  And if you want to block, then use rules to block local network see https://help.firewalla.com/hc/en-us/articles/4408644783123-Building-Network-Segments

  0

  Comment actions Permalink
• 

  Angel Wash

  • January 12, 2023 20:24

  You can turn off firewalla SSH settings->advanced->configurations->ssh

  There is no ssh section. There is "SSH Console" section and in that section there is no turn off option. The comment in that sections says that SSH service is always on, and can't be turned off. I never generated a password so far. But there are people who are trying to guess the password on the local network.

   

  I have Segmented Network already. 2 separate LANs. I just want to block SSH access to Firewalla router on a specific network/LAN only.

  The network is 192.168.50.1/24 but I can't block "192.168.50.1:22"

  I get error message saying I can't block Firewalla box.

  What is the right way to do this?

   

  0

  Comment actions Permalink
• 

  Angel Wash

  • January 14, 2023 23:54
  • Edited

  @Firewalla

  I found that the turn off buttons/switches appears in the SSH Console section when you create a password which is great.

  I have two requests:

  1. Can you please let users decide the length of the password? For example: Min 10, max: 30 etc.

  2. Can you please enable one of the following use cases for users? Ideally both of them would be great!

  • Users can use turn off switches in non-password created state as well.
  • Users can add a rule manually to block port 22 for router IP address. In case we decide to use that port for something else.

  I believe these are reasonable requests.

   

  0

  Comment actions Permalink
• 

  Mark W Abbott

  • February 15, 2024 01:24

  This is important.  I have a flow setup and allows me to manually block the IP's that the router identifies are guessing the SSH password.  I add a couple every day.  Firewalla would benefit from an automatic routine to block these, rather than making me manually block them every 8 or 10 hours.

  0

  Comment actions Permalink

Please sign in to leave a comment.