Hot!Fortigate V5.4 IPS signature to block the FTP anonymous account

Author
kenchang0708
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/04/15 01:49:35
  • Status: offline
2019/04/15 01:59:59 (permalink)
0

Fortigate V5.4 IPS signature to block the FTP anonymous account

Hi all,
 
My customer want to block the anonymous user to upload files to the internet FTP servers, otherwise the normal account can do that.
 
I tried to add the IPS signature as below, but it didn't work in version 5.4.
 
================================
Name: FTP_unauth_login
Signature: F-SBID( --protocol tcp; --flow from_client; --dst_port 21; --pattern "PASS|20 0d 0a|"; --context packet; --within 7,context; --no_case; --data_size =7; --tag set,Tag.FTP.unauthenticated.user;)

Name: FTP_unauth_PUT
Signature: F-SBID( --protocol tcp; --flow from_client; --dst_port 21; --pattern "STOR|20|"; --context packet; --within 5,context; --no_case; --tag test,Tag.FTP.unauthenticated.user;)

Name: FTP_unauth_STOR
Signature: F-SBID( --protocol tcp; --flow from_client; --dst_port 21; --pattern "PUT|20|"; --context packet; --within 4,context; --no_case; --tag test,Tag.FTP.unauthenticated.user;)
================================
 
I tested some situations to tried and found out that, the "Tag.FTP.unauthenticated.user" parameter could not be searched.
 
Do you know how to modify the parameter in version 5.4?
 
 
Thanks and Best Regards,
Ken
 
#1

0 Replies Related Threads

    Jump to:
    © 2019 APG vNext Commercial Version 5.5