3

When using an SRX (we have a 1400) to protect a server we can create an application-ddos rule for DNS, but what if we want to protect it against SQL exploit attempts like "SaAdmin" login attempts?

In the JUNOS guide, it states,

"Note: Application-level denial-of-service (application-level DDoS) detection will not work if two rules with different application-level DDoS applications process traffic going to a single destination application server."

It's almost as if you can protect a server from only one protocol's exploits at a time. If that's not the case, how is it done? I haven't seen a single configuration for SRX IDP that shows a specific destination protected for more than a single application/protocol. What happens if you want to protect your webserver from HTTP and FTP exploits?

  • I'm not an expert on AppDDoS, so I can't answer all of this. Junpier does have signatures for detecting brute force attempts to SQL; such as DB:MS-SQL:MSSQL-LGN-BRUTE-FORCE for MySQL brute forcing. – Ryan Foley Jul 9 '15 at 19:24
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 19:34
3

I would recommend not using AppDDoS moving forward. Juniper announced its deprecation some time ago, and this is probably the reason you can't find many solid examples of its use: http://kb.juniper.net/InfoCenter/index?page=content&id=KB28592&actp=search&viewlocale=en_US&searchid=1374905420170

Ironically, that KB recommends using the DDos Secure Product which has also been canned.

To somewhat reproduce AppDDoS behaviour, you can do the following:

Create a custom-attack referencing the protocol you are specifically hunting (e.g.: SQL), and just pick a context to match a normal operation (e.g.: mssql-login). You can then apply time-binding count 100 to it, which basically means - if you see 100 of these within a minute, this is an attack. The scope variable determines: from a single source to multiple destinations (DoS), from multiple sources to a single destination (DDoS), or just a single a single peer to a single destination.

The whole thing looks like:

custom-attack SQL-DDOS {
    recommended-action drop;
    severity major;
    time-binding {
        count 100;
        scope destination;
    }
    attack-type {
        signature {
            context mssql-login;
            direction client-to-server;
            protocol {
                tcp {
                    destination-port {
                        match equal;
                        value 1433;
                    }
                }
            }
        }
    }
}

Reference your attack(s) in an IPS policy, and make the then term something like:

idp-policy FRONTEND-SERVICS {
   rulebase-ips {
        rule SQL-SERVER {
            match {
                application junos-ms-sql;
                attacks {
                    custom-attacks SQL-DDOS;
                }
            }
            then {
                action {
                    drop-connection;
                }
                ip-action {
                    ip-block;
                    target source-address;
                    log;
                    timeout 60;
                    refresh-timeout;
                }
            }
        }
    }
}

This will put in an ip-block action against any source addresses that trigger this attack for 1 minute, and if any further attacks from the same source are detected (e.g.: it's a dumb bot), keep restarting the 60-second timer every time you see one.

  • I like this approach and will use it, but I fear I wasn't clear in my approach- I use IDP policy now, but in specifying an application for a specific ip endpoint destination, you are then not allowed to apply another IDP application policy against the same endpoint. So for instance, I can block DNS attacks very elegantly with a custom attack referencing a DNS application. But in stopping those DNS attacks to the DNS server, I'm not allowed to configure a subsequent rule to protect against FTP attacks with an FTP application definition against the same endpoint DNS server. – danno Aug 7 '15 at 19:14
  • Although a little counter-intutitive, I tend to let the security policy dictate specific traffic to an endpoint, then just configure IDP rules to only match on applications rather than destination addresses - this way, FTP and DNS attacks will be blocked against all DNS and FTP traffic (even traffic traversing a non-standard port, or to an unexpected host). – Benjamin Dale Aug 8 '15 at 3:37
  • Now that is very interesting, I am definitely going to approach my config from that standpoint, thank-you. – danno Aug 10 '15 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.