topic Re: Block SSH and allow SFTP in Network Security

Block SSH and allow SFTP

harish.ab — Mon, 11 Mar 2019 15:07:40 GMT

Hello Guys,

Is there any way to block SSH and allow only SFTP?

Thanks in advance

Re: Block SSH and allow SFTP

andrew.prince — Fri, 20 Mar 2009 08:53:36 GMT

No - SSH and SFTP use the same default TCP port of 22.

Now what you can do is change the server to use a different SFTP port instead of TCP/22 - to something else.

HTH>

Re: Block SSH and allow SFTP

newatcisco — Fri, 20 Mar 2009 09:45:17 GMT

How do you block ssh version 1 and allow only ssh version 2 across the ASA?

Re: Block SSH and allow SFTP

andrew.prince — Fri, 20 Mar 2009 10:22:27 GMT

AFAIK - the ASA will not inspect the version of SSH as it passes thru it. If you only want to allow version 2 of SSH - then configure the server to only accept version 2

Re: Block SSH and allow SFTP

cisco24x7 — Fri, 20 Mar 2009 13:54:07 GMT

That is NOT an acceptable solution. Let say that your SSH server is located in the DMZ network and that you want to make it accessible to both Intranet and Internet users. With Intranet users, you want to give them the option to use either ssh version 1 or version 2; however, for Internet users, they are forced to use ssh version 2 for enhanced security. Most people want to it on the firewall which makes sense.

Re: Block SSH and allow SFTP

andrew.prince — Fri, 20 Mar 2009 14:14:46 GMT

So how do you configure the firewall to filter on the version then, as the version is session based information?

Re: Block SSH and allow SFTP

cisco24x7 — Fri, 20 Mar 2009 15:12:37 GMT

I have not used ASA in a while so I could be wrong here but it can not be done on ASA appliance.

Other vendors such as Juniper and Checkpoint, you can define a service "ssh" and "ssh_version_2". That way, the firewall can look at the initial hand-shake of the ssh connection and determine whether it is an ssh version 1 or ssh version 2 connection. If you specify ssh, it will assume both version 1 and version 2. If you specify ssh version_2, it will only accept only version through the firewall.

For intranet users, you use ssh. For Internet users that require enhanced security, only ssh version 2 is allowed.