Security offload for SFTP

Question

What's the latest status about offloading SFTP/SSH? Is this still not possible? I'm looking for an alternative solution to offload some security features for SFTP, because due to SNAT the server only sees the LBs IP-address and therefor can't use this for the blacklist. Disabling SNAT and having the LB as DFGW for the server is not an option. And as SFTP doesn't support and kind of XFF, I was wondering if I can use any nice iRule to check for not allowed usernames or the number of failed login attempts. We also have only LTM module available.
Thanks for any ideas or further information!
Regards Stefan 🙂

paulius · Answer

Stefan_KlotzI don't believe you can with just LTM. I have been poking around in the various option for TCP connections but I can't seem to find any values pertaining to SSH sessions before they form. You can log client IP for every SSH sessions but I don't see a way currently to match that to SSH session on the server side to have that correlation.

daniel_wolf · Answer

Hi Stefan_Klotz,
did you consider using AFM and SSH Proxy?AskF5 &gt;&gt; Secure SSH traffic with the SSH Proxy&nbsp;
KRDaniel

Forum Discussion

Security offload for SFTP

2 Replies

Recent Discussions

Error when running bigip_command Playbook against LTM : Syntax Error: unexpected argument /bin/sh\n

Can iRule be used to perform exception of IPI category based on Geolocation

Can iRule mask the payload content on event logs of security

minimum tmos software version for connect CIS (openshift)

Chrome V 124+ on MacOS - Virtual Server Access Issue

Related Content

Using ChatGPT for security and introduction of AI security

Auditing Security Policy Updates

HTTP Multipart and Security Implications

Using Distributed Application Security Policies in Secure Multicloud Networking Customer Edge Sites

Minimizing Security Complexity: Managing Distributed WAF Policies