topic Re: SSH Inspection in Firewall and Security Management

SSH Inspection

bob111 — Mon, 01 Apr 2024 12:58:35 GMT

Hello friends!
I am currently looking into implemnting ssh inspection feature for the checkpoint security gateway, and I was unable to find a lot of information or guides on this feature (except the two minimal guides on the checkpoint site) so I would be glad if someone can point me to a more comprehensive guide or document, or maybe answer some of my questions regarding this feature - the ssh client needs to ssh to the security gateway or to the ssh server (and the session just passes the security gateway)?

Thanks in advance:)

Re: SSH Inspection

the_rock — Mon, 01 Apr 2024 13:26:37 GMT

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_ThreatPrevention_AdminGuide/Topics-TPG/Using-SSH-Inspection.htm

Re: SSH Inspection

Timothy_Hall — Mon, 01 Apr 2024 14:40:56 GMT

The only resource for SSH Deep Packet Inspection is the one @the_rock provided in the formal documentation. Most people aren't even aware this feature exists since it can't be configured in the SmartConsole GUI. You may also see references to "RDP Inspection" if you look around in the documentation hard enough; this feature had a very short lifespan and is no longer present.

Re: SSH Inspection

bob111 — Mon, 01 Apr 2024 14:59:53 GMT

Thank you very much for the replies!
What do you mean by "no longer present"?

Re: SSH Inspection

the_rock — Mon, 01 Apr 2024 15:18:53 GMT

Maybe you can confirm with TAC if they have any other additional info about it.

Andy

Re: SSH Inspection

ww1m6 — Sun, 07 Apr 2024 11:15:07 GMT

Hello @Timothy_Hall, did you mean that ssh inspection is a feature that is no longer present or rdp inspection?

Re: SSH Inspection

ww1m6 — Sun, 07 Apr 2024 12:58:39 GMT

Hi @Timothy_Hall, The ssh inspection feature had a very short lifespan and is no longer present or the rdp inspection?

Re: SSH Inspection

Timothy_Hall — Sun, 07 Apr 2024 13:20:06 GMT

RDP Inspection is no longer present. See here: Remote Desktop Inspection Still Supported?

Re: SSH Inspection

the_rock — Sun, 07 Apr 2024 13:42:34 GMT

ssh inspection is still supported, but rdp inspection is not, as per link Tim sent.

Andy

Re: SSH Inspection

Daniel_Kavan — Tue, 16 Apr 2024 20:43:20 GMT

Once ssh inspection is turned on (ion), does that mean all current ssh traffic going thru the gw will break until you add all the public and private keys to the gw? With 'https inspection', you can bypass traffic you don't want inspected.

Re: SSH Inspection

PhoneBoy — Tue, 16 Apr 2024 21:40:29 GMT

If I'm understanding the documentation correctly, we are only inspecting SSH connections where the public (and private) key is added to the gateway.
However, I haven't tested this.

Re: SSH Inspection

ww1m6 — Sun, 12 May 2024 12:40:11 GMT

You need to add the private key to the gateway? The documentation says you only need to add the public key

Re: SSH Inspection

PhoneBoy — Mon, 13 May 2024 15:14:32 GMT

You can add the private key to improve the user experience, but it's not a requirement.

Re: SSH Inspection

ww1m6 — Mon, 13 May 2024 15:18:52 GMT

I understand. I followed the guide for configuring the ssh inspection but where can I actually see that the ssh traffic to the ssh server that it's key I added to the gateway is being inspected?

Re: SSH Inspection

PhoneBoy — Tue, 14 May 2024 17:16:59 GMT

What does cpssh_config istatus tell you?

Re: SSH Inspection

the_rock — Tue, 14 May 2024 17:19:17 GMT

Man, learn something new from you all the time, I never knew of that command before 🙂

Andy

Re: SSH Inspection

ww1m6 — Tue, 14 May 2024 17:24:02 GMT

SSH Inspection is enabled

Re: SSH Inspection

PhoneBoy — Tue, 14 May 2024 22:02:56 GMT

Well, that's a start.

The best way to confirm is via telnet to port 22 to the protected server.
This (along with troubleshooting) is listed at the bottom of the documentation linked earlier in this thread.

Re: SSH Inspection

ww1m6 — Wed, 15 May 2024 13:21:29 GMT

Yes, I tried it but I did not get the result shown in the documentation. Am I supposed to be able to see the ssh traffic inspected in the logs on the management server?

Re: SSH Inspection

PhoneBoy — Fri, 17 May 2024 02:13:57 GMT

If it's not showing the Check Point specific SSH banner, then it's not doing inspection.
Recommend engaging with TAC for further assistance: https://help.checkpoint.com