Issue with SFTP Connection - Forward Proxy
Hi All, I am facing issue with SFTP forward proxy virtual server. I have this VS with below details: Source: 10.244.0.0/16 Destination: 0.0.0.0/0 Dst Port: 8822 irule --> which redirects the connection to port 22 there are many other SFTP applications running smoothely except one on which Vendor 3Econ.com applied security patch named Serv-U post that our application team is facing issue. I had taken packet captures however there is nothing suspicious about F5. Is any anyone faced such issue after update of Serv-U patch on SSH servers. Below is the links shared by vendor regarding the patch. Below is a link to the “Release Notes” for ServU 15.3.1 and 15.3.2 Please review https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-2_release_notes.htm https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-1_release_notes.htm Supported Key Exchange, SSH Ciphers and SSH MACs for ServU Key Exchange (KEX), SSH ciphers and SSH MACs supported in Serv-U (solarwinds.com) If anyone can help me what I can check, will be really helpful also if needed I can share wireshark captures. TIA, Ashish SolankiSecurity offload for SFTP
What's the latest status about offloading SFTP/SSH? Is this still not possible? I'm looking for an alternative solution to offload some security features for SFTP, because due to SNAT the server only sees the LBs IP-address and therefor can't use this for the blacklist. Disabling SNAT and having the LB as DFGW for the server is not an option. And as SFTP doesn't support and kind of XFF, I was wondering if I can use any nice iRule to check for not allowed usernames or the number of failed login attempts. We also have only LTM module available. Thanks for any ideas or further information! Regards Stefan 🙂
Log source IP address
Hi We have a FTP and SFTP Server farm load-balanced by GTM and LTM appliances. since it is FTP (port 21) and SFTP (port 22), the clients/source that tries to connect to the Wide IP (gslb site) pass through the GTM and LTM (based on the load-balancing methods) ends up in any of the server nodes as designed. However, since the LTM VIP is the one that connects to the Server nodes (within the pool), these End Server Nodes see the LTM VIP IP as the source IP and has no trace of the actual connecting source IP Addresses. we did some research and it looks like the source IP can be traced/logged through the http headers for http traffic and not possible for FTP or SFTP Traffic. Can someone please suggest any option where, 1. Either the Destination Servers can retrieve and log the Source IP Addresses 2. Or atleast if the LTM can log the Source IP address with Time stamps. thank you in advance! -- Nirmal
Sticky Persistence with SSH?
I have a VIP for SFTP set on my LTM, and it is using a persistence profile. The profile is: Persistence type - Source Affinity Address Parent profile - souce_addr Timeout - 960 seconds Map Proxies - enabled This set up when was suggested by a former team member back when I was just learning to work with the LTM. My application team is now asking me if the sticky persistence is necessary for SSH, so I'm looking for any advise / options for this configuration. Thanks, Ray
Irule to strip header Xforwarded ssh/sftp
I have an Irule that strips out the xforwarded header information and passes the client IP to our servers instead of the F5 IP. I would like to set up an Irule to strip header Xforwarded for ssh/sftp requests. Has anyone tried this before or know of a link? I have searched dev central with no luck. Thanks in advance
SFTP External Monitor fails but manual script execution succeeds
Hi, I've been working on setting up an SFTP monitor for some time now. I'm getting really close but there's one thing left that I'm having a hard time understanding and is just not working as expected. Here is the base script: !/bin/bash IP=`echo ${1} | sed 's/::ffff://'` PORT=${2} sftp -o Port=${PORT} -b /home/ext_monitor/cyclone/sftpmonitor.input sftpMonitor@${IP} | grep 'IB' 2>$1 > /dev/null mark node UP if expected response was received if [ $? -eq 0 ] then echo "UP" fi When I upload this script to the F5 and execute it manually (using IP and Port arguments in-line) it works just fine. What I'm trying to do is attach this to the pool level; there are 4 pool members and my understanding is the first two variables ($1 (ipv6 address) and $2 (port)) are auto-populated by the F5 when it tries connecting in the external monitor, but the monitor was failing. Next, I modified the script a bit so that instead of using IP and PORT variables, I just hard-coded one of the pool member information and attached the monitor at the pool member level, but that also failed. Any assistance I could get would be very appreciated... I feel like I'm very close and just missing a couple key things here. Here's the current monitor configuration: ltm monitor external external-sftp-cyclone { defaults-from external destination *:* interval 5 run /Common/external-cyclone-sftp-2022 time-until-up 0 timeout 16 } Also, in case it is relevant: I do also have a tcp monitor attached alongside it as I cannot risk the pool member going down at this time while I test this.
iRule to restrict SFTP by name
I'm needing a treatment by iRule so I accept SFTP connections just by name. For example, a request for "sftp.domain.com" should refer to the pool named pool_sftp_port22. I have seen that more people with special needs have not yet been found in a solution. The version of my BigIP LTM is 11.6.0.SFTP decryption?
I've seen old answers about SFTP decryption not being possible, but I want to check if that is still the case. I'm on 11.5.3, but would also like to know if something newer would make it possible. I would re-encrypt it to the pool member, but want to log some text from the session via an iRule.SFTP Scripting
Using the BIG-IP client I'd like to script a batch file to copy several files to an SFTP server. I have seen some posts in the forum but none of them mention on where to supply a password in the statement. I have seen the below but I don't see how I can supply a password. scp /path/to/localfile user@host:/path/to/dest Any help is greatly appreciated.SFTP decryption?
I've seen old answers about SFTP decryption not being possible, but I want to check if that is still the case. I'm on 11.5.3, but would also like to know if something newer would make it possible. I would re-encrypt it to the pool member, but want to log some text from the session via an iRule.
