/
How to Configure SSH

How to Configure SSH

The SSH daemon listens on the management IP address on TCP port 22. Connect to the firewall with SSH when performing software updates or other special maintenance tasks. You can use both external SSH clients, or connect via the SSH tab in Barracuda Firewall Admin.

You can use an external SSH client to open an SSH connection to the Barracuda CloudGen Firewall. You can also use the terminal integrated in Barracuda Firewall Admin; direct access to the Barracuda CloudGen Firewall is provided via SSH version 2. To access the SSH terminal, click the SSH tab. 

You can enable event notifications for SSH, as well as view the SSH log for information such as system access and remote command execution. In the Select Log File list on the Logs page, you can find the sshd log file in the Box directory.

Using an External SSH Client

If you prefer to use your own SSH client, configure Barracuda Firewall Admin with the path to the executable:

  1. In Firewall Admin, click on the hamburger menu on the top left to expand the options tab.

  2. Select Settings.

  3. Expand the Client Settings section.

  4. In the External SSH Client field, enter the command for the external SSH client. Use %ip and %user to dynamically insert the IP address and username. E.g., C:\putty.exe %user@%ip

Configure SSH

Step 1. Configure Basic Settings

  1. Go to CONFIGURATION > Configuration Tree > Box > Advanced Configuration > SSH.

  2. Click Lock.

  3. To configure the general settings for SSH, click Basic Setup from the Configuration menu in the left navigation pane.

  4. On the Basic Setup page for SSH, you can configure the following settings in the General Settings section:

    • Event for SSH – Specifies if event notifications should be triggered when the system succeeds or fails to start up or shut down (Events Daemon Startup Failed/Succeeded [2070/2071] and Daemon Shutdown Failed/Succeeded [2072/2073]).
      You can select any of the following options:

      • Startup Failure

      • Startup/Shutdown Failure

      • Startup/Shutdown Failure + Startup Success

      • Startup/Shutdown Failure + Startup/Shutdown Success

    • Allow TCP Forwarding – Specifies if TCP is enabled or disabled. This setting is only available in Advanced View mode.

    • Login Timeout – The maximum length of time in seconds that a user has to successfully log in before the server disconnects. The minimum time limit is 10 seconds. The default length of time is 90 seconds. 

    • Permit Root Login – Permits or prohibits SSH logins for the root user.

    • Check User Home – (Only available in Advanced View mode) Specifies whether sshd should check file modes and ownership of the user's files and home directory before accepting login. This is normally desirable because novices sometimes accidentally leave their directories or files writable. The default is yes.

Step 2. Configure Settings for SSH Version 2

To configure settings that are specific to SSH version 2:

  1. Click Advanced Setup from the Configuration menu in the left navigation pane.

  2. You can configure the following settings:

    • Client Alive Interval – Timeout interval in seconds after which, if no data has been received from the client, sshd will send a message through the encrypted channel to request a response from the client. If set to 0, no message will be sent.

    • Max. Client Alive Messages – Number of client alive messages that may be sent without sshd receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session.

    • Allow Compression – Specifies if compression should be enabled or disabled for SSH clients.

    • Force Key Authentication – (Only available in Advanced View mode) Specifies if key usage is mandatory or optional for SSH clients.

    • Secure FTP Support – (Only available in Advanced View mode) Specifies if sshd implements the sftp subsystem. Secure FTP may be viewed as a more comfortable alternative to the simple scp command when trying to transfer bulk data to or from the box.

    • Use DSA Keys – (Only available in Advanced View mode) To enhance security, other key types will be preferred over DSA keys. Disabling DSA keys increases security, but breaks the SSH communication with HA partners, Control Centers, or managed firewalls if the release version is below 7.1.0.

Step 3. Configure Brute Force Protection

Enable Brute Force Protection to let the the system watch login attempts of every account and block an account after a given number of consecutive failed logins. Brute Force Protection does not tell a possible attacker that their account got blocked.

  1. On the Advanced Setup page, configure the following settings in the Brute Force Protection Settings section:

    • Enable Brute Force Protection – Enable or disable Brute Force Protection.

    • Maximum Login Attempts – Number of unsuccessful login attempts after which an account should be blocked.

    • Cooldown Time – Time in seconds after which a login using the locked account should be possible again after the account has been locked out of the system.

  2. Click Send Changes and Activate.

Step 4. Expert Settings

Expert settings can be accessed by clicking Switch to Advanced configuration mode in the left menu column.

CAUTION: The following settings are recommended to be changed ONLY BY EXPERTS!

For more information on Ciphers, KexAlgorithms, and MACs, see the ‘man pages’ for SSHd_config.

ssh_expert_settings.png

The following configuration options are:

  1. Ciphers

    1. Specifies the allowed ciphers. If you must use multiple ciphers, you must separate them with a comma. If the specified list begins with a '+' character, then the specified cipher will be appended to the default set instead of replacing them. If the specified list begins with a ‘-’ character, then the specified ciphers (including wildcards) will be removed from the default set instead of replacing them. If the specified list begins with a ‘^’ character, then the specified ciphers will be placed at the head of the default set.

    2. The supported ciphers are:

      1. 3des-cbc

      2. aes128-cbc

      3. aes192-cbc

      4. aes256-cbc

      5. aes128-ctr

      6. aes192-ctr

      7. aes256-ctr

      8. aes128-gcm@openssh.com

      9. aes256-gcm@openssh.com

      10. chacha20-poly1305@openssh.com

    3. The default is:
      chacha20-poly1305@openssh.com,
      aes128-ctr,aes192-ctr,aes256-ctr,
      aes128-gcm@openssh.com
      aes256-gcm@openssh.com

    4. The list of available ciphers may also be obtained using "ssh -Q cipher".

  2. Kex Algorithms

    1. Specifies the available KEX (Key Exchange) algorithms. Multiple algorithms must be comma-separated. Alternately if the specified list begins with a ‘+’ character, then the specified algorithms will be appended to the default set instead of replacing them. If the specified list begins with a ‘-’ character, then the specified algorithms (including wildcards) will be removed from the default set instead of replacing them. If the specified list begins with a ‘^’ character, then the specified algorithms will be placed at the head of the default set.
      The supported algorithms are:

      1. curve25519-sha256

      2. curve25519-sha256@libssh.org

      3. diffie-hellman-group1-sha1

      4. diffie-hellman-group14-sha1

      5. diffie-hellman-group14-sha256

      6. diffie-hellman-group16-sha512

      7. diffie-hellman-group18-sha512

      8. diffie-hellman-group-exchange-sha1

      9. diffie-hellman-group-exchange-sha256

      10. ecdh-sha2-nistp256

      11. ecdh-sha2-nistp384

      12. ecdh-sha2-nistp521

      13. sntrup761x25519-sha512@openssh.com

  3. MACs

    1. Specifies the available MAC (message authentication code) algorithms. The MAC algorithm is used for data integrity protection. Multiple algorithms must be comma-separated. If the specified list begins with a ‘+’ character, then the specified algorithms will be appended to the default set instead of replacing them. If the specified list begins with a ‘-’ character, then the specified algorithms (including wildcards) will be removed from the default set instead of replacing them. If the specified list begins with a ‘^’ character, then the specified algorithms will be placed at the head of the default set.

      The algorithms that contain "-etm" calculate the MAC after encryption (encrypt-then-mac). These are considered safer and their use recommended.
      The supported MACs are:

      1. hmac-md5

      2. hmac-md5-96

      3. hmac-sha1

      4. hmac-sha1-96

      5. hmac-sha2-256

      6. hmac-sha2-512

      7. umac-64@openssh.com

      8. umac-128@openssh.com

      9. hmac-md5-etm@openssh.com

      10. hmac-md5-96-etm@openssh.com

      11. hmac-sha1-etm@openssh.com

      12. hmac-sha1-96-etm@openssh.com

      13. hmac-sha2-256-etm@openssh.com

      14. hmac-sha2-512-etm@openssh.com

      15. umac-64-etm@openssh.com

      16. umac-128-etm@openssh.com

    2. The default is:
      umac-64-etm@openssh.com, umac-128-etm@openssh.com,
      hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com,
      hmac-sha1-etm@openssh.com,
      umac-64@openssh.com, umac-128@openssh.com,
      hmac-sha2-256,hmac-sha2-512,hmac-sha1

    3. The list of available MAC algorithms may also be obtained using "ssh -Q mac".

  4. PerSourceMaxStartups

    1. Specifies the number of unauthenticated connections allowed from a given source address, or none if there is no limit. This limit is applied in addition to MaxStartups, whichever is lower. The default is none.

Contact Us
Barracuda Campus
Barracuda Support