topic Re: mobile access portal logs in Firewall and Security Management

mobile access portal logs

Jonathan — Thu, 25 Aug 2022 08:55:09 GMT

Hi,
We use a mobile access portal, let's say portal.company.com
Let's say someone tries to attack us like this: portal.company.com/sslvpn<script>

They get an error screen which is provided by the GW:

I'm trying to find evidence for this request in the logs but can't find it.
Is it being logged? if yes, how can I filter the logs to find it?
Thanks

Re: mobile access portal logs

PhoneBoy — Thu, 01 Sep 2022 23:23:49 GMT

The Access Log won't necessarily show it, though it might show the HTTPS connection without the URL.
You might find it somewhere in $CPVPNDIR/log.

Re: mobile access portal logs

Jonathan — Mon, 12 Sep 2022 07:54:42 GMT

Hi PhoneBoy,

Couldn't find any log files under $CPVPNDIR (version 81.10).

Tried searching other folders such as "/opt/CPVPNPortal/logs" but couldn't find any relevant logs.

Re: mobile access portal logs

G_W_Albrecht — Mon, 12 Sep 2022 13:52:34 GMT

sk115110: "Access denied. The destination of your request has not been configured or you do not have authorization to access it." error

Re: mobile access portal logs

Arnon_Azmon — Tue, 13 Sep 2022 09:49:35 GMT

Hi G_W_Albrecht,

This is not the issue of this post, we're not having problems with our portal.

I'm just trying to find where are the logs for access attemps to this portal, which also includes the url entered.

Re: mobile access portal logs

G_W_Albrecht — Tue, 13 Sep 2022 09:51:45 GMT

I linked the SK because of:

SmartView Tracker log shows:

Product:  Mobile Access
Reason: The requested destination is not configured for this user's group in the Mobile Access policy.
Mobile Access Category:	Web
Access:   	Denied
Resource:  http://10.x.x.x:80/sig.php

Here the URL is displayed...

Re: mobile access portal logs

Arnon_Azmon — Tue, 13 Sep 2022 10:29:40 GMT

Oh, I see...

unfortunately I can't see such logs in my system (R81.10).

Also, this error page only pops up when you try somehing like "https://portal.company.con/gibrish" but if you try to access the login page and add parameters such as portal.company.com/sslvpn/Login/Login?script<1=1> it just ignores it, but I still want to know about it

Re: mobile access portal logs

G_W_Albrecht — Tue, 13 Sep 2022 11:00:16 GMT

Legacy SVTracker does not show much, too ! i would suggest to call CP TAC !

Re: mobile access portal logs

G_W_Albrecht — Tue, 13 Sep 2022 11:49:33 GMT

Have a look at /var/log/opt/CPcvpn-R81.10/log/httpd.log

Re: mobile access portal logs

Jonathan — Tue, 13 Sep 2022 12:24:59 GMT

Already tried that but this log only shows many error and fail messages such as:

[69152][13 Sep 15:18:30][fdt] getCurlCrlOcspDir: failed to create directory: curl_crl_ocsp
[69152][13 Sep 15:18:30] registry_root_reload: Could not reload: Registry file doesn't exists or corrupted. Reverting to old version.
[69152][13 Sep 15:18:30] cpIsDir: Calling cpIsDirEx: Permission denied
[69152][13 Sep 15:18:30] cpFileCopy: failed to fopen64 source file, calling fopen: Permission denied
[69152][13 Sep 15:18:30] cpFileCopy: failed to fopen source file: Permission denied
[69152][13 Sep 15:18:30] registry_revert_to_old_version: Revert error: failed to copy /opt/CPshrd-R81.10/registry/HKLM_registry.data.old -> /opt/CPshrd-R81.10/registry/HKLM_registry.data_69152.tmp: Permission denied
[69152][13 Sep 15:18:30] registry_root_reload: Could not reload: Revert failed, file doesn't exists or corrupted.
[69152][13 Sep 15:18:30] registry_root_reload: Could not reload: Registry file doesn't exists or corrupted. Reverting to old version.
[69152][13 Sep 15:18:30] cpIsDir: Calling cpIsDirEx: Permission denied

Re: mobile access portal logs

G_W_Albrecht — Tue, 13 Sep 2022 12:33:17 GMT

YOu have to record the exact time you open the link in browser and find that in log !

Re: mobile access portal logs

Jonathan — Tue, 13 Sep 2022 12:39:52 GMT

Well I did that of course, but the lines I pasted in my previous reply are the only ones I see in this log.

I don't know if it's supposed to be like this...

Re: mobile access portal logs

G_W_Albrecht — Tue, 13 Sep 2022 12:52:31 GMT

Open a SR# with TAC to get to the logs !

Re: mobile access portal logs

Jonathan — Mon, 24 Oct 2022 07:38:50 GMT

Hi,

Quick update - I contacted TAC but after many investigation they came to the conclusion that for these logs I need to enable some other blades that we don't have, and they redircted me to our account owner at Checkpoint...

Thank you for trying to help

Re: mobile access portal logs

PhoneBoy — Mon, 24 Oct 2022 18:17:56 GMT

Can you send me the TAC SR in a private message?

Re: mobile access portal logs

Jonathan — Tue, 25 Oct 2022 06:01:03 GMT

Sure, I've sent it in PM