topic Re: No authentication for port 18231 Policy Server Login (old) in General Topics

No authentication for port 18231 Policy Server Login (old)

Jason_Dance — Fri, 30 Nov 2018 16:13:22 GMT

Hello fellow community members!

Our security vulnerability scan has flagged that there is no authentication algorithm / ciphers for connections to port 18231 on our gateways (which according to the awesome diagram from Heiko Ankenbrand is "Policy Server Login (old)").

As we're using E80.xx Endpoint protect against a separate Policy server, I'm guessing we don't use this port any more (perhaps it was for the older R75 VPN client??).

Does anyone know of a way to secure this port, either by blocking it, or by making it offer secure SSL ciphers??

Regards,

Jason

Re: No authentication for port 18231 Policy Server Login (old)

PhoneBoy — Fri, 30 Nov 2018 18:25:00 GMT

Vulnerability scan shows port 18231 open under LISTEN mode when using TLS1.0 and TLS1.1

Re: No authentication for port 18231 Policy Server Login (old)

HeikoAnkenbrand — Sat, 01 Dec 2018 10:22:17 GMT

Yes, with a SYN scan you see the port as open.

If you check the TLS certificates, you see an TLS handshake.

Afterwards the Check Point communication follow.

Regards

Heiko

Re: No authentication for port 18231 Policy Server Login (old)

Jason_Dance — Mon, 03 Dec 2018 20:17:49 GMT

Thanks Dameon Welch-Abernathy‌.

Do you know if the E80.xx client will have any issues with setting this to TLS1.2?

Re: No authentication for port 18231 Policy Server Login (old)

PhoneBoy — Mon, 03 Dec 2018 20:51:58 GMT

Possible some older VPN clients might.

Re: No authentication for port 18231 Policy Server Login (old)

Jason_Dance — Mon, 03 Dec 2018 20:53:44 GMT

Interesting. I applied the first two options in SK132712 to my R77.30 gateways, and the nmap scan has not shown any improvement.

PORT STATE SERVICE VERSION

18231/tcp open ssl/fw1-pslogon Check Point FireWall-1 Policy Server logon

| ssl-enum-ciphers:

| TLSv1.0:

| ciphers:

| TLS_DH_anon_WITH_3DES_EDE_CBC_SHA - F

| TLS_DH_anon_WITH_AES_128_CBC_SHA - F

| TLS_DH_anon_WITH_AES_256_CBC_SHA - F

| compressors:

| NULL

| cipher preference: client

|_ least strength: F

Re: No authentication for port 18231 Policy Server Login (old)

Antonis_Hassiot — Tue, 18 May 2021 13:49:18 GMT

Any update here? We also performed the actions mentioned here:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk132712

for port 18231, but the port still shows as listening.

The following line was already commented out as follows:

/*#define ENABLE_FW1_PSLOGON_NG*/

Re: No authentication for port 18231 Policy Server Login (old)

MaxGutberletRM — Mon, 16 Aug 2021 11:06:59 GMT

Just tried the same on 80.40 but without any apparent success either. Despite /*#define ENABLE_FWD_TOPO*/ and /*#define ENABLE_FW1_PSLOGON_NG*/ - validated on the MGR and on the two cluster members - the FW still listens on 18231 and fails basic PCI scan using Qualys.

Re: No authentication for port 18231 Policy Server Login (old)

_Val_ — Mon, 16 Aug 2021 13:18:08 GMT

Did you reboot or ran cpstop;cpstart after the modifying the files?

Re: No authentication for port 18231 Policy Server Login (old)

_Val_ — Mon, 16 Aug 2021 13:19:00 GMT

Also, read by the SK, you need to run additional modifications through SmartConsole

Re: No authentication for port 18231 Policy Server Login (old)

MaxGutberletRM — Mon, 16 Aug 2021 14:07:09 GMT

Already did that obviously - multiple times.

But we found the issue: we had a old EXPLICIT policy rule active that allowed 18231 to connect to the FW. So the implicit rules were disabled but an explicit rule still existed.

In addition to that, the statemet in the SK "You can disable the daemon completely by editing the implied_rules.def, and removing/commenting the relevant lines:" is incorrect - all you remove is the _access_ to the daemon but the daemon is still started which you can easily ceck by running the netsat on the GW which still shows the daemon listening.

But at least the PCI scan now is ok with the FW

Re: No authentication for port 18231 Policy Server Login (old)

Antonis_Hassiot — Mon, 23 Aug 2021 08:01:59 GMT

We found that the port was disabled only after unticking Policy Server box and leaving it unticked. We didn't actually need Policy Server enabled. Otherwise the port would show as listening in netstat.

Re: No authentication for port 18231 Policy Server Login (old)

_Val_ — Mon, 23 Aug 2021 08:10:38 GMT

Strangely enough, that too is mentioned in the sk132712 you referenced above yourself.

Anyway, I am glad you have found the solution.