{"id":207,"date":"2020-07-05T12:29:57","date_gmt":"2020-07-05T11:29:57","guid":{"rendered":"http:\/\/www.labtinker.net\/?p=207"},"modified":"2020-07-05T12:29:57","modified_gmt":"2020-07-05T11:29:57","slug":"securing-sftp","status":"publish","type":"post","link":"http:\/\/18.135.13.153\/?p=207","title":{"rendered":"Securing SFTP?"},"content":{"rendered":"\n

I recently came upon a situation where there was a request to allow an SFTP connection out to the Internet for secure file transfer. My previous posts have been concerned with stopping SSH tunnels on non-standard ports but some may have viewed this as an academic exercise as most enterprises insist outbound connections are made through a proxy server. <\/p>\n\n\n\n

A proxy understands HTTP (including HTTPS as most proxies implement SSL interception) and FTP and can inspect these traffic streams for threats. You can also proxy SFTP (and other things) but need to use the HTTP Connect method or a SOCKS proxy to do this. Both of these methods deny the proxy any visibility of the traffic. First a word on SFTP:<\/p>\n\n\n\n

SFTP is not related to FTP \u2013 save by the name which is misleading. SFTP (and SCP for that matter) run their file transfer service using SSH. My confusion on this matter was cleared up by the book \u2018SSH \u2013 The Secure Shell\u2019 by Barrett, Silverman and Byrnes published by O\u2019Reilly): a refreshingly dead-tree reference for you that goes into much more detail.<\/p>\n\n\n\n

(FTPS is different again, this is FTP over SSL but I\u2019m not going there)<\/p>\n\n\n\n

I googled a bit and found out that Palo Alto did SSH-proxying which sounded promising.<\/p>\n\n\n\n

https:\/\/docs.paloaltonetworks.com\/pan-os\/9-0\/pan-os-admin\/decryption\/decryption-concepts\/ssh-proxy.html#id2053e5f5-25e0-4543-b372-b2e027316753<\/a>)<\/p>\n\n\n\n

and with this lead I headed to my virtual lab (Well, AWS: I know, I know, but, damn, these cloud platforms are handy)<\/p>\n\n\n\n

The Goal<\/strong><\/p>\n\n\n\n

My goal in this lab was to see if I could intercept a dummy virus in an sftp file transfer. <\/p>\n\n\n\n

The Lab<\/strong><\/p>\n\n\n\n

Firstly, I needed an SFTP server. In the AWS marketplace I found a pre-baked one:<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"\"
Figure 1: SFTP Server.<\/figcaption><\/figure>\n\n\n\n

And as we’re going to take a Palo for a spin, we also need:<\/p>\n\n\n\n

\"\"
Figure 2: Firewall du jour<\/figcaption><\/figure>\n\n\n\n

I used the lab topology that I have favoured recently. To pad out the blog (and save you scrolling down) reproduced here:<\/p>\n\n\n\n

\"\"
Figure 3: Today’s lab<\/figcaption><\/figure>\n\n\n\n

Working from the DMZ windows machine shown, I downloaded my dummy virus file from eicar ( https:\/\/www.eicar.org\/<\/a>). I got evidence that this worked fromthe Windows Servers’ pre-installed version of Windows Defender which quarantined the file.<\/p>\n\n\n\n

\"\"
Figure 4: Windows defender defends.<\/figcaption><\/figure>\n\n\n\n

So, after nobbling this…<\/p>\n\n\n\n

\"\"
Figure 5: Down, boy!<\/figcaption><\/figure>\n\n\n\n

I downloaded my eicar file again and using the Filezilla SFTP client on the Windows machine. (https:\/\/filezilla-project.org\/<\/a>). I connected to my SFTP server and copied up a copy of a normal text file (so good, it was suffixed twice) and my dummy virus file (eicar.txt) with no problem.<\/p>\n\n\n\n

\"\"
Figure 6: Copying a normal and dummy virus file to SFTP server.<\/figcaption><\/figure>\n\n\n\n

OK, time to break out our Anti-Virus on the Palo. Now there was bit of faffing around with this which I will reproduce here as if I need to do this again I can remind myself of the loops I had to jump through. <\/p>\n\n\n\n

The default AV profile doesn’t actually mention ssh in its decoders but anyway… <\/p>\n\n\n\n

\"\"
Figure 6a – Palo’s default Anti-Virus profile.<\/figcaption><\/figure>\n\n\n\n

<\/p>\n\n\n\n

OK, in the decryption profile for ‘SSH Proxy’ I initially ticked all the boxes, as you do, but this caused issues (see later) possibly because I was using SFTP – I don’t know. In the end I unticked all the extra options:<\/p>\n\n\n\n

\"\"
Figure 7: SSH Proxy in Decryption Profile.<\/figcaption><\/figure>\n\n\n\n

In the Palo, you set up decryption rules to match the traffic you want decrypting (more usually for SSL). So having created my decryption profile I added in a decryption rule as follows:<\/p>\n\n\n\n

\"\"
Figure 8: Decrypt rule source<\/figcaption><\/figure>\n\n\n\n
\"\"
Figure 9: Decrypt rule destination<\/figcaption><\/figure>\n\n\n\n
\"\"
Figure 10: Decrypt rule port<\/figcaption><\/figure>\n\n\n\n
\"\"
Fig 11: Decrypt Options<\/figcaption><\/figure>\n\n\n\n

I set up the default AV profile on my outbound Access rule..<\/p>\n\n\n\n

\"\"
Figure 12: Select default AV profile.<\/figcaption><\/figure>\n\n\n\n
\"\"
Figure 13: Rule using said AV profile.<\/figcaption><\/figure>\n\n\n\n

Initially I got this when I tried to commit this policy…<\/p>\n\n\n\n

\"\"
Figure 14: Ooops<\/figcaption><\/figure>\n\n\n\n

So, note to self, the AWS Palo doesn’t come pre-loaded with AV signatures and why would it?<\/p>\n\n\n\n

I went over to the dynamic updates….<\/p>\n\n\n\n

\"\"
Figure 15: Dynamic Updates<\/figcaption><\/figure>\n\n\n\n

…restored an AWS Elastic IP address to my Palo’s managment interface (where the update traffic originates from) and then downloaded and installed the AV sigs..<\/p>\n\n\n\n

\"\"
Figure 16: AV signatures in place.<\/figcaption><\/figure>\n\n\n\n

Initially, when connecting from the Windows DMZ server to my SFTP server I saw this in Filezilla…<\/p>\n\n\n\n

\"\"
Figure 17: Filezilla error.
<\/figcaption><\/figure>\n\n\n\n

And this in the logs…<\/p>\n\n\n\n

\"\"
Figure 18: Unsupported ssh<\/figcaption><\/figure>\n\n\n\n

…so I adjusted my SSH Proxy profile as detailed above and pressed on whereupon I was able to connect successfully to the server, (good) and transfer my eicar profile (bad). The following log excerpt doesn’t really show that but does show we aren’t decrypting..<\/p>\n\n\n\n

\"\"
Figure 19: No decryption.<\/figcaption><\/figure>\n\n\n\n

This is when my faith in the wisdom of my enterprise began to falter and I fully read the Palo link I’d shared above. (I like to demonstrate to the wisdom of RTFM by generally failing to do so until forced.)<\/p>\n\n\n\n

This is the relevant excerpt<\/p>\n\n\n\n

When the client sends an SSH request to the server to initiate a session, the firewall intercepts the request and forwards it to the server. The firewall then intercepts the server response and forwards it to the client. This establishes two separate SSH tunnels, one between the firewall and the client and one between the firewall and the server, with firewall functioning as a proxy. As traffic flows between the client and the server, the firewall checks whether the SSH traffic is being routed normally or if it is using SSH tunneling (port forwarding). The firewall doesn\u2019t perform content and threat inspection on SSH tunnels<\/strong>; however, if the firewall identifies SSH tunnels, it blocks the SSH tunneled traffic and restricts the traffic according to configured security policies.<\/em><\/p>\n\n\n\n

This confused me a little bit. Initially I interpreted it as saying that the firewall can’t inspect SSH but I believe it means you it can’t intercept another protocol tunnled over SSH which is fair enough. Doesn’t that mean SSH and SFTP traffic should be inspected for threats?<\/p>\n\n\n\n

I decided to try the decrypt rule with plain old SSH and so spun up an AWS Linux server and tried to connect to this from my Windows DMZ machine. I found I couldn\u2019t connect through the firewall when the \u2018ssh-proxy\u2019 decrypt rule was enabled; though could when I disabled this rule. I guess this was because AWS SSH authentication uses the public\/private key method rather than a password and the firewall is a MITM. I didn\u2019t dwell on this but it proved the ssh-proxy rule was intercepting SSH (and thus SFTP) and so should have decrypted SFTP.<\/p>\n\n\n\n

My conclusions based on the limited time and effort I was able to put in, was that ssh interception didn’t work with SFTP nor with SSH when using public\/private key. I was mainly interested in the former use-case. It could be that I’m doing something wrong but there doesn’t seem as if there should be that much to it, following Palo’s how-to.<\/p>\n\n\n\n

For some reason, I didn’t find this blog on the same subject written by Phoneboy five years ago when I first searched. Here is his eloquent take on the matter:<\/p>\n\n\n\n

http:\/\/phoneboy.org\/2015\/07\/29\/lies-damn-lies-and-inspecting-ssh-traffic-securely\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

I recently came upon a situation where there was a request to allow an SFTP connection out to the Internet for secure file transfer. My previous posts have been concerned with stopping SSH tunnels on non-standard ports but some may have viewed this as an academic exercise as most enterprises insist outbound connections are made […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,12],"tags":[],"class_list":["post-207","post","type-post","status-publish","format-standard","hentry","category-firewalls","category-security"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts\/207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=207"}],"version-history":[{"count":0,"href":"http:\/\/18.135.13.153\/index.php?rest_route=\/wp\/v2\/posts\/207\/revisions"}],"wp:attachment":[{"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=207"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/18.135.13.153\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}