CPUG

The Check Point User Group

A Resource For The Check Point Community.  Fast.  Useful.  Independent.

1. Come to CPUG CON 2008 EUROPE in Switzerland on September 8th - 9th!
    Two days full of technical content for Check Point administrators in the beautiful Swiss Alps!
    We already have sign-ups from twelve different countries!
2. CCSA/CCSE One-Week Dual-Certification Training Course with CPUG in San Francisco!
    Courses Starting 7/14, 8/25, 10/6, 11/3, 12/8, (2009) 1/19, 2/9, 3/9, 4/6, 5/4, 6/8.
3. Corrent S3500 SecureXL Turbocards For Sale - Last Six Remaining - Get Your Spares!
4. Join Us On LinkedIn - We now have a CPUG group.


Go Back   CPUG: The Check Point User Group > Check Point Firewall-1/VPN-1 And Related Products > Miscellaneous
Reload this Page Access Violation
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 2008-02-11
avilT avilT is offline
Member
  
Join Date: 2006-03-14
Posts: 71
Rep Power: 3
avilT has an average reputation (10+)
Default Access Violation
I am running Checkoint NGFP3 pn Nokia IP 350.
I am getting the below log on syslog server, what is the meaning of this log? Is someone trying to get access of the firewall? How can I trace the source IP?
-------------------------------------------------------------------------
Feb 9 09:28:39 FW02 [LOG_ERR] PAM_unix[542]: bad username [*** W A ]
Feb 9 09:28:39 FW02 [LOG_ERR] PAM_unix[542]: bad username [ |]
Feb 9 09:28:39 FW02 [LOG_ERR] PAM_unix[542]: bad username [| ]
Feb 9 09:28:39 FW02 [LOG_ERR] PAM_unix[542]: bad username [| This ]
Feb 9 09:28:44 FW02 [LOG_ERR] PAM_unix[542]: bad username [| to au]
Feb 9 09:28:54 FW02 [LOG_ERR] PAM_unix[542]: bad username [| attem]
Feb 9 09:29:09 FW02 [LOG_ERR] PAM_unix[542]: bad username [| respo]
Feb 9 09:29:29 FW02 [LOG_ERR] PAM_unix[542]: bad username [| If yo]
Feb 9 09:29:54 FW02 [LOG_ERR] PAM_unix[542]: bad username [| ]
Feb 9 09:30:24 FW02 [LOG_ERR] PAM_unix[542]: bad username [+-------]
Feb 9 09:30:24 FW02 [LOG_NOTICE] PAM_unix[542]: 1 LOGIN FAILURE ON ttyd0
Feb 9 09:30:24 FW02 [LOG_NOTICE] PAM_unix[542]: 1 LOGIN FAILURE ON ttyd0, +-------
Feb 9 09:30:29 FW02 [LOG_ERR] PAM_unix[10347]: bad username [$G^G^G^G]
Feb 9 09:31:02 FW02 [LOG_ALERT] PAM_unix[10347]: check pass; user unknown
Feb 9 09:31:02 FW02 [LOG_NOTICE] PAM_unix[10347]: authentication failure; root(uid=0) -> G^G^G^G^ for login service
Feb 9 09:31:04 FW02 [LOG_ERR] PAM_unix[10347]: auth_pam: Authentication service cannot retrieve authentication info.
Feb 9 09:31:15 FW02 [LOG_ALERT] PAM_unix[10347]: check pass; user unknown
Feb 9 09:31:15 FW02 [LOG_NOTICE] PAM_unix[10347]: authentication failure; root(uid=0) -> n failed for login service
Feb 9 09:31:16 FW02 [LOG_ERR] PAM_unix[10347]: auth_pam: Authentication service cannot retrieve authentication info.
Feb 9 09:31:18 FW02 [LOG_ALERT] PAM_unix[10347]: check pass; user unknown
Feb 9 09:31:18 FW02 [LOG_NOTICE] PAM_unix[10347]: authentication failure; root(uid=0) -> Verifica for login service
Feb 9 09:31:20 FW02 [LOG_ERR] PAM_unix[10347]: auth_pam: Authentication service cannot retrieve authentication info.
Feb 9 09:31:33 FW02 [LOG_ALERT] PAM_unix[10347]: check pass; user unknown
Feb 9 09:31:33 FW02 [LOG_NOTICE] PAM_unix[10347]: authentication failure; root(uid=0) -> n failed for login service
Feb 9 09:31:35 FW02 [LOG_ERR] PAM_unix[10347]: auth_pam: Authentication service cannot retrieve authentication info.
Feb 9 09:31:46 FW02 [LOG_ERR] PAM_unix[10347]: bad username [ failed.]
Reply With Quote
  #2 (permalink)  
Old 2008-02-13
RayPesek RayPesek is offline
Senior Member
  
Join Date: 2006-03-19
Location: Northern Ohio
Posts: 862
Rep Power: 3
RayPesek has an average reputation (10+)
Default Re: Access Violation
Access to the firewall itself should be limited by a rule so only the IP addresses of the administrators can access it to login. Logging on that rule would tell you who it is.

From the first lines of the text it looks almost like a script or someone messing with you.

Ray
Reply With Quote
  #3 (permalink)  
Old 2008-02-14
chuachongchee chuachongchee is offline
Senior Member
  
Join Date: 2007-09-17
Location: Singapore
Posts: 151
Rep Power: 1
chuachongchee has an average reputation (10+)
Default Re: Access Violation
Hmm... are you opening up SSH to the outside??

You should stealth your firewall frm Internet man... i once saw this too.. continously for 5 days... on the 5th day... my firewall couldn't take it no more and hanged... haha...
Reply With Quote
  #4 (permalink)  
Old 2008-02-16
avilT avilT is offline
Member
  
Join Date: 2006-03-14
Posts: 71
Rep Power: 3
avilT has an average reputation (10+)
Default Re: Access Violation
Yes, I do have the stealth rule with logging. Apart from that I have access lists on the internet routers as well. I donot see any TCP connections from outside to the firewall even though there are some UDP connection attempts to the firewall which are passing thru router ACL's and reaching the firewall.
Last edited by avilT; 2008-02-16 at 22:43.
Reply With Quote
  #5 (permalink)  
Old 2008-02-16
chuachongchee chuachongchee is offline
Senior Member
  
Join Date: 2007-09-17
Location: Singapore
Posts: 151
Rep Power: 1
chuachongchee has an average reputation (10+)
Default Re: Access Violation
Quote:
Originally Posted by avilT View Post
Yes, I do have the stealth rule and ssh is now allowed as I have access lists on the internet routers as well. Why the source IP is not logged?
Not too sure... i once encounter on R62 UTM-1, allowing checkpoint management connections opens up the ssh too!!...

Did you log the stealth rule?? Ensure the rules are right on top, but below your vpn rules, mgmt rules etc...

Are the other logging for the other rules working?? If so, i would think that stealth rule is not logged...

Try to ssh into your firewall... then do "fw ctl zdebug drop" then try run a ssh from internet see if its logged, you can oso do the same with tcpdump or fw monitor...
Reply With Quote
  #6 (permalink)  
Old 2008-02-16
eduardw eduardw is offline
Member
  
Join Date: 2007-08-04
Posts: 50
Rep Power: 1
eduardw has an average reputation (10+)
Default Re: Access Violation
For good workings of the stealth rule make sure the the topology of your firewall object is correct.

Eduard
Reply With Quote
Reply

« Previous Thread | Next Thread »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are Off
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT -7. The time now is 01:54.

Contact Us - CPUG Home Page - Archive - Top

Powered by vBulletin® Version 3.7.2
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
LinkBacks Enabled by vBSEO 3.0.0