topic Re: Allow SSH to Application "bitbucket" in Firewall and Security Management

Allow SSH to Application "bitbucket"

D_W — Tue, 30 Apr 2024 14:45:03 GMT

Hi Mates,

tried to allow ssh access to bitbucket.org via the official provided Application-Object "Bitbucket".
This object includes Port 80,433,22 etc.

For https traffic the rule matches but not for ssh traffic.
SSL-Inspection is not active.
Gateway Version R81.10 T130.

Workaround is to allow ssh to the Bitbucket IP-Ranges.

Someone else with this issue?

Cheers,
David

Re: Allow SSH to Application "bitbucket"

Bob_Zimmerman — Tue, 30 Apr 2024 15:43:41 GMT

Application/Site objects can only match HTTP-like traffic. SSH doesn't quite use TLS (it uses most of the same primitives, but the negotiation is very unlike a TLS Client Hello), so enabling SSL Inspection almost certainly won't help.

You could use an FQDN object. These cause the firewall to look up the name in the object in the background and cache the IPs returned in a table which is then consulted when trying to match the object. For this to work reliably, clients must use the same DNS resolution path as the firewall.

Re: Allow SSH to Application "bitbucket"

PhoneBoy — Tue, 30 Apr 2024 17:50:05 GMT

According to this, SSH should be one of the supported ports for Bitbucket:

Not sure how it is detecting the use of Bitbucket over SSH, though...

Re: Allow SSH to Application "bitbucket"

the_rock — Tue, 30 Apr 2024 18:34:53 GMT

Yup, just checked R81.20, shows the same.

Andy

Re: Allow SSH to Application "bitbucket"

D_W — Mon, 13 May 2024 12:42:28 GMT

So who can tell us❓

Re: Allow SSH to Application "bitbucket"

the_rock — Mon, 13 May 2024 12:44:01 GMT

Did you ever open TAC case to get an official answer?

Andy

Re: Allow SSH to Application "bitbucket"

PhoneBoy — Mon, 13 May 2024 16:44:22 GMT

Either this built-in service is incorrect (SSH isn't supported) or the behavior is not correct.
Either way, the TAC should be involved: https://help.checkpoint.com