This article provides information on how to prevent SSH flood attacks on SRX devices.

During an SSH flood attack, the RE and PFE CPU usage may spike. Additionally, multiple SSH login failures may appear in the system message logs. These failures are typically associated with repeated unauthorized login attempts from various IP addresses.

Example log entries:

root@SRX> show log messages | match sshd | last 100
Jun 2 03:25:04 SRX sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '81.184.24.36'
Jun 2 03:25:04 SRX sshd[6881]: Received disconnect from 81.184.24.36 port 48694:11: Bye Bye [preauth]
Jun 2 03:25:04 SRX sshd[6881]: Disconnected from authenticating user root 81.184.24.36 port 48694 [preauth]
Jun 2 03:25:04 SRX inetd[2253]: /usr/sbin/sshd[6881]: exited, status 255
Jun 2 03:26:17 SRX sshd[6933]: Failed password for rancher from 27.254.163.61 port 43742 ssh2
Jun 2 03:26:17 SRX sshd: SSHD_LOGIN_FAILED: Login failed for user 'rancher' from host '27.254.163.61'
Jun 2 03:26:17 SRX sshd[6933]: Received disconnect from 27.254.163.61 port 43742:11: Bye Bye [preauth]
Jun 2 03:26:17 SRX sshd[6933]: Disconnected from authenticating user rancher 27.254.163.61 port 43742 [preauth]
Jun 2 03:26:17 SRX inetd[2253]: /usr/sbin/sshd[6933]: exited, status 255
Jun 2 03:26:25 SRX sshd[6941]: Failed password for root from 220.247.223.56 port 34792 ssh2
Jun 2 03:26:26 SRX sshd: SSHD_LOGIN_FAILED: Login failed for user 'root' from host '220.247.223.56'
Jun 2 03:26:26 SRX sshd[6941]: Received disconnect from 220.247.223.56 port 34792:11: Bye Bye [preauth]
Jun 2 03:26:26 SRX sshd[6941]: Disconnected from authenticating user root 220.247.223.56 port 34792 [preauth]
Jun 2 03:26:26 SRX inetd[2253]: /usr/sbin/sshd[6941]: exited, status 255
Jun 2 03:26:53 SRX sshd[6986]: Connection reset by 177.125.136.158 port 41014 [preauth]
Jun 2 03:26:53 SRX inetd[2253]: /usr/sbin/sshd[6986]: exited, status 255
Jun 2 03:27:32 SRX sshd[7175]: Failed password for osboxes from 103.23.198.220 port 54372 ssh2
Jun 2 03:27:32 SRX sshd: SSHD_LOGIN_FAILED: Login failed for user 'osboxes' from host '103.23.198.220'
Jun 2 03:27:32 SRX sshd[7175]: Received disconnect from 103.23.198.220 port 54372:11: Bye Bye [preauth]
Jun 2 03:27:32 SRX sshd[7175]: Disconnected from authenticating user osboxes 103.23.198.220 port 54372 [preauth]

To prevent SSH flood attacks and restrict unauthorized access, follow the steps below to harden your Juniper device:

Step 1: Remove SSH Access from External Zones

Ensure that SSH services are not exposed to untrusted networks. Remove SSH services from the external security zone.

Step 2: Configure Login Attempt Limits

Implement login attempt restrictions to mitigate brute-force attacks. Refer to the following document: [SRX] How to block Telnet and SSH Brute Force log-in attacks

Step 3: Apply a Protect-RE Filter on the Loopback Interface

Configure a loopback filter to restrict SSH and Telnet access to only trusted IP ranges and block all other unwanted traffic.

Example Configuration:

set interfaces lo0 unit 0 family inet filter input local_acl
set firewall family inet filter local_acl term terminal_access from source-address 192.168.1.0/30
set firewall family inet filter local_acl term terminal_access from protocol tcp
set firewall family inet filter local_acl term terminal_access from port ssh
set firewall family inet filter local_acl term terminal_access from port telnet
set firewall family inet filter local_acl term terminal_access then accept
set firewall family inet filter local_acl term tcp-estab from protocol tcp
set firewall family inet filter local_acl term tcp-estab from tcp-established
set firewall family inet filter local_acl term tcp-estab then accept
set firewall family inet filter local_acl term terminal_access_denied from protocol tcp
set firewall family inet filter local_acl term terminal_access_denied from port ssh
set firewall family inet filter local_acl term terminal_access_denied from port telnet
set firewall family inet filter local_acl term terminal_access_denied then log
set firewall family inet filter local_acl term terminal_access_denied then reject
set firewall family inet filter local_acl term default-term then accept

Notes:

• The terminal_access term explicitly allows SSH and Telnet only from the trusted subnet 192.168.1.0/30.
• The terminal_access_denied term logs and rejects unauthorized SSH/Telnet access attempts.
• The tcp-estab term permits established TCP sessions, ensuring uninterrupted communication for legitimate sessions.
• The default-term ensures all other traffic is allowed unless otherwise specified above.