Jump to:navigation, search
Wiki

IDS / IPS - FailToBan function

From Securepoint Wiki



























Fail2Ban 
































represents the IP of a host for which the admin interface has been blocked (accessible by default at https://192.168.175.1:11115).
Services that can be released:admin-ui sshd user-ui smtp }}









sollte über den notempty
HTTP-Proxy der UTM
 laufen. Er kann dann auf
  • Schadcode ( Einstellungen unter Applications HTTP Proxy Virenscanner ) und *unerwünschte Inhalte (Einstellungen unter Applications Webfilter )

überprüft werden.

| Network traffic running through the notempty
HTTP proxy of UTM
 can be can be scanned for
  • malicious code ( settings in Applications HTTP proxy virus scanner ) and
  • unwanted content' (settings under Applications Web Filter ).}}






De.png
En.png
Fr.png









Description of Intrusion Detection and Intrusion Prevention Functions

Last adaptation to the version: 14.0.1 (01.2025)

New:
notempty
This article refers to a Resellerpreview
Access: UTM-IP:Port or UTM-URL:Port
Port as configured at Network / Appliance Settings / Webserver
Default-Port: 11115
i.e.: https://utm.ttt-point.de:11115
Default: https://192.168.175.1:11115 Applications IDS/IPS


Preamble

IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) can detect and prevent attacks from the Internet or a network.
These features are useful for stopping the server from flooding with malicious connection attempts.


Firewall monitoring

Activation of monitoring

The activation / deactivation of the monitoring is done in the menu Firewall Implicit rules in the group 'BlockChain'.

On BlockChain
The monitoring for these accesses can be switched off.
Default Rule Description
On FailToBan_ssh Access by ssh
On FailToBan_http_admin Access via the Admin interface
On FailToBan_http_user Access via the user interface
On FailToBan_smtp Access via the mail gateway


Bans

Bans

Access to the firewall can be blocked after a certain number of incorrect login attempts.
The settings are configured in the Applications IDS/IPS menu.

Caption Value Description IDS / IPS UTMuser@firewall.name.fqdnApplication UTM v12.6.2 IDS-IPS Sperrungen-en.pngTab IDS/IPS - Bans
Status The "IPS Locks" application is enabled.
The "IPS Locks" application is disabled.
Never blocked addresses and zones: »internal These IP addresses and zones, are not blocked by IDS/IPS. Examples: »internal »external_v6 »vpn-ipsec »192.0.2.192
 Protected Services 
The following values can be configured :
Service   Service to be protected
  • Since all four services are already configured at delivery, + Add can be used to select services only after they have been removed.
    • admin-ui Authentication via the admin interface.
    (default login port for administrators under 192.168.175.1:11115)
    smtp Authentication via the mail gateway
    sshd Authentication via ssh protocol (e.g. PuTTY)
    user-ui Authentication via the user interface.
    Default login port for users under: 192.168.175.1:443
    measurement time 86400Link= seconds measurement time can be counted within the failed attempts.
    Max. attempts 3Link= Number of failed authentication attempts notempty
    Irrespective of this, after the 6th consecutive failed attempt, a flat-rate login throttling for the admin and user interface, as well as an error message in the respective web interface, takes effect
     notempty
    New as of v12.7.0
    Ban time 3600Link= seconds Period for which access to this authentication is blocked.
  • Maximum ban time: 2147483 seconds (around 25 days)
    •
     Current ban 
    The following blocks can be cancelled with .     		UTM v11-8 F2B Zeitlinie 1b.png
    Time course without blocking     UTM v11-8 F2B Zeitlinie 2b.png
    Time course with blocking
    Service The service for which the block is active
    IP The IP address that is blocked
    Remaining ban time The remaining time of the ban in seconds


    Releasing blocked accesses again

    Under  Current bans , blocked IP addresses can be released again for renewed access to a service before the ban time expires with the button ⤺.
    Unlocking is also possible via the CLI: 

    utm.name.local> spf2bd ip remove service admin-ui ip 192.0.2.192

    Here the ip {code


    Notification of bans

    In the Alerting Center you can set under IPS Lockouts whether and how you want to be notified about such lockouts.























































    Systemweite Sperrungen

    notempty
    Aufruf Verschoben und Layout aktualisiert zur v14.0.1

    Unter Applications IDS/IPS  Area Systemweite Sperrungen lassen sich systemweite Sperrungen von IP-Adressen bewirken.

    Es können einzelne IP-Adressen oder ganze GeoIP Gruppen als Quellen und/oder Ziele blockiert werden.
    notempty
    These settings apply system-wide in all zones and are applied before the packet filter rules!
    Caption Value Description Implied Rules UTMuser@firewall.name.fqdnFirewall UTM v14.0.1 IDS IPS Systemweite Sperrungen-en.pngKonfiguration für Systemweite Sperrungen

    IP-Adressen

    IP-Adressen
    notempty
    New as of v14.0.1
    Quell-Adressen systemweit ablehnen: Yes Aktiviert das Ablehnen von IP-Adressen als Quellen
    Ziel-Adressen systemweit ablehnen: Yes Aktiviert das Ablehnen von IP-Adressen als Ziele
    IP-Adressen: »203.0.113.13 IP-Adressen, die systemweit auf allen Schnittstellen blockiert werden
  • Im Log erscheint dazu unter Alle Paketfilter-Meldungen
    z.B.: ulgogd REJECT: IPBlockingList_RejectSrc
  • Es können nur einzelne IP-Adressen, keine Range, blockiert werden

    • GeoIP Quellen

    GeoIP Quellen
    GeoIP Quellen systemweit ablehnen: On Activates the GeoIP settings for rejected sources
    System-wide dropped sources: »BX (random example) In the click box, countries can be selected that are to be blocked as sources.
    Group: All Selection from preset groups, which selects e.g. all countries of a continent.
    Add Adds the regions from the selected group
    Remove Removes the regions from the selected group
    Exceptions: »IP address Exceptions for system-wide rejected sources can be defined here.

    GeoIP Ziele

    GeoIP Ziele
    GeoIP Ziele systemweit ablehnen: On Activates the GeoIP settings for rejected destinations
    System-wide dropped destinations: BX (random example) In the click box, countries can be selected that are to be blocked as targets.
    This prevents access via browsers as well as, for example, downloaded malicious code.
    Group: All Selection from preset groups, which selects e.g. all countries of a continent.
    Add Adds the regions from the selected group
    Remove Removes the regions from the selected group
    Exceptions: IP address Exceptions for system-wide rejected destinations can be defined here.


    Cyber Defence Cloud

    Cyber Defence Cloud
    The Threat Intelligence Filter logs or blocks access to potentially dangerous remote peers based on the IP address, regardless of the protocol used. As soon as a connection is established to an IP address that is known, for example, as a control server for malware, the Threat Intelligence Filter detects this.

    The filter updates itself automatically in the background via the Securepoint Cyber Defence Cloud.
    Block such connections with Log and drop connection: Yes

    		IDS / IPS UTMuser@firewall.name.fqdnApplication UTM v12.6.2 IDS-IPS Cryber Defence Cloud-en.pngCyber Defence Cloud
    • For New installations, the Log and drop connection option is enabled
    • For Updates the option Log connection is enabled.
    notempty
    We strongly recommend to activate this option !

    If a connection is blocked due to the Threat Intelligence Filter, a log entry is created.
    Notification of these log messages can be configured in Alerting Center.
    Default: Level 8 - Alarm → Message: Malicious connection detected. → Immediate Report & Regular Report


    Invalid TCP Flags

    Invalid TCP Flags
    notempty
    By a change / adjustment of the settings within this section, it can come to problems within the network.
         		IDS / IPS UTMuser@firewall.name.fqdnApplication UTM v12.7.0 IDS-IPS Ungueltige TCP-Flags-en.pngInvalid TCP Flags
    The detection of known flags in the TCP protocol can be enabled or disabled in the Invalid TCP Flags tab.
    With the buttons AllSomeNone the settings can be controlled centrally.


    Trojans

    Trojans
    To make it more difficult for trojans to penetrate and spread in the network, access to ports known to be used by some trojans can be blocked here.
    To do this, On closes all (header) or individual ports that are assigned to individual Trojans.
    In case of problems with other software that also uses such ports, only selected entries can be activated. notempty
    New as of v12.7.0
     With the buttons AllSomeNone the settings can be controlled centrally.notempty
    For comprehensive proactive protection, we recommend using the Thread Intelligence Filter, which blocks access based on known IP addresses.
         		IDS / IPS UTMuser@firewall.name.fqdnApplication UTM v12.7.0 IDS-IPS Trojaner-en.pngTrojans

    Blocked ports overview

    Trojans Port
    Back Door Setup TCP 5000
    Backage Trojan TCP 411
    Back Door:G TCP 1234
    SkyDance Trojan TCP 4000
    CrackDown Trojan TCP 4444
    DaCryptic Trojan TCP 1074
    DerSphere TCP 1000
    DerSphere 2 TCP 2000
    Freak2k TCP 7001
    GateCrasher Trojan TCP 6970
    Hacka Tack TCP 31785 - 31792
    ICKiller TCP 1027
    ICQ Nuke 98 Trojan TCP 1029
    NetSpy Trojan TCP 1024
    Kaos Trojan TCP 1212
    Kuang2 Trojan TCP 17300
    Mneah Trojan TCP 4666
    Multidropper Trojan TCP 1035
    NoBackO Trojan TCP 1201
    Maniac Rootkits TCP 6667
    RAT Trojan TCP 1097 - 1098
    Remote Storm TCP 1025
    RexxRave Trojan TCP 1104
    Shadyshell Trojan TCP 1337
    Subseven TCP 27374
    Terror Trojan TCP 3456
    TheFlu Trojan TCP 5534
    TransScout Trojan TCP 2004 - 2005
    Trinoo Trojan TCP 1524
    WinHole Trojan TCP 1081
    Xanadu Trojan TCP 1031

















































    Connection Rate Limit

    Throttling of access from certain source IPs to recurring ports

    notempty

    The function is still in the testing phase and will be further expanded.
    The function can initially only be configured via the CLI

    The function aims to protect against attacks.
    SSL-VPN accesses can be protected against aggressive scans or login attempts, for example.

    Connection Rate Limit.png
    Connection Rate Limit Access.png

    From v12.6.2, the UTM can limit the number of TCP and/or UDP connections from an external IP address to one port.
    The following conditions apply:

    • Only incoming connections for which a default route exists are monitored
    • The connections from an IP address to a port of the UTM are counted within one minute
    • When activated, 5 connections / connection attempts per minute are permitted.
      The connections are then limited:
      • The additionally permitted connections are distributed evenly within 60 seconds of the first connection.
      • With a CONNECTION_RATE_LIMIT value of 20, an additional connection is added every 3 seconds.
      • 10 seconds after the first login, 3 further connections could be established (each from the same IP address to the same destination port)
    • Blocking an IP address only affects access to the port that has been used too often.


    Other ports can still be accessed.

    • The function is activated by default for new installations on 20 UDP connections / minute on all ports
    • For Updates the function must be manually activated
    extc-Variable Default Description
    CONNECTION_RATE_LIMIT_TCP 0 Number of permitted TCP connections of an IP address per port
    0 = Function deactivated, no blocking is performed
    CONNECTION_RATE_LIMIT_TCP_PORTS Ports to be monitored. Empty by default=all ports would be monitored (if activated).
    Individual ports are separated by spaces: [ 1194 1195 ]
    CONNECTION_RATE_LIMIT_UDP 20 / 0
    Default setting for new installations from v12.6.2: 20
    For update installations the value is 0, so the function is deactivated.
    		Number of permitted UDP connections of an IP address per port
    CONNECTION_RATE_LIMIT_UDP_PORTS Ports to be monitored. Empty by default=all ports are monitored (only for new installations!).
    Individual ports are separated by spaces: [ 1194 1195 ]

    Configuration with CLI commands

    CLI command Function
    extc value get application securepoint_firewall
    Alternatively as root user:
    spcli extc value get application securepoint_firewall | grep RATE     		Lists all variables of the securepoint_firewall application.
    The variables beginning with CONNECTION_RATE_LIMIT_ are responsible for the connection limit.

    application |variable |value --------------------+-------------------------------+----- securepoint_firewall |… |… |CONNECTION_RATE_LIMIT_TCP |0 |CONNECTION_RATE_LIMIT_TCP_PORTS| |CONNECTION_RATE_LIMIT_UDP |20 |CONNECTION_RATE_LIMIT_UDP_PORTS|

    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP value 20
    system update rule    		 Limits the allowed number of TCP connections from a single IP address to a specific port to 20 per minute
  • A change is made directly by a rule update.
    The value must not be set to 0 first!
    • extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP value 0
    system update rule    		 Deactivates the monitoring of TCP connections
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP_PORTS value [ 443 11115 ]
    system update rule     		Restricts the monitoring of TCP connections to ports 443 and 11115
    There must be spaces before and after the square brackets [ ]!
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP_PORTS value [ ]
    system update rule    		 There must be spaces before and after the square brackets [ ]!
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP value 20
    system update rule    		 Limits the allowed number of UDP connections from a single IP address to a specific port to 20 per minute
    Default setting for new installations from v12.6.2: 20
    For update installations the value is 0, so the function is deactivated.
  • A change is made directly by a rule update.
    The value must not be set to 0 first!
    • extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP value 0
    system update rule    		 Deactivates the monitoring of UDP connections
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP_PORTS value [ 1194 1195 ]
    system update rule     		Restricts the monitoring of UDP connections to ports 1194 and 1195.
    (Example for 2 created SSL-VPN tunnels).
    There must be spaces before and after the square brackets [ ]!
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP_PORTS value [ ]
    system update rule    		 There must be spaces before and after the square brackets [ ]!

    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP value 20
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_TCP_PORTS value [ 443 11115 ]
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP value 20
    extc value set application securepoint_firewall variable CONNECTION_RATE_LIMIT_UDP_PORTS value [ ]
    system update rule

    notempty

    Finally, the CLI command system update rule must be entered so that the values in the rules are applied.

    		For example, to allow a maximum of 20 connections per minute per IP address and port. For TCP, monitoring is restricted to ports 443 and 11115. All ports are monitored for UDP connections.
    Retrieved from "https://wiki.securepoint.de/index.php?title=UTM/APP/IDS-IPS&oldid=94515"