Description

This article provides information on how to detect the Embryonic connection (half open), as this is a vulnerability.

Symptoms

  • To detect the Embryonic connection (half open) for the SSH protocol.
  • To verify when connections are open for SSH (half open or failed sessions). These connections will not allow more connections, which is defined in the connection-limit.

Solution


{master:0}
root@TEST> show configuration system services ssh
protocol-version v2;
connection-limit 5;
rate-limit 5;

{master:0}
root@TEST> show system processes extensive | match sshd
PID      USERNAME  THR PRI NICE   SIZE     RES      STATE   TIME   WCPU  COMMAND
18029 root                        1  96         0  7068K  2404K   select    0:00    0.00%   sshd < Established Session (Session 1)

{master:0}
root@TEST> Jan 12 21:30:45 TEST sshd[19033]: Failed password for from 10.130.35.3 port 1798 ssh2 < Session Failed (Session 2)


{master:0}
root@TEST> show system processes extensive | match sshd
PID       USERNAME THR  PRI  NICE  SIZE      RES      STATE   TIME   WCPU   COMMAND
19033  root                      1      4          0  5860K  2328K   sbwait   0:00    0.59%    sshd
18029  root                      1    96          0  7068K  2404K   select    0:00    0.00%    sshd
19034  sshd                    1    96          0  5700K  1216K   select    0:00    0.00%    sshd

{master:0}
root@TEST> Jan 12 21:31:06 TEST sshd[19036]: Failed password for from 10.130.35.3 port 1800 ssh2 < Session Failed (Session 3)


{master:0}
root@TEST> show system processes extensive | match sshd
PID        USERNAME  THR  PRI  NICE   SIZE       RES         STATE    TIME    WCPU   COMMAND
19036  root                        1       4         0   5860K    2328K     sbwait    0:00     0.40%    sshd
18029  root                        1     96         0   7068K   2404K     select      0:00     0.00%    sshd
19033  root                        1       4         0   5860K   2328K      sbwait    0:00     0.00%    sshd
19034  sshd                      1    96         0   5700K   1216K      select     0:00     0.00%    sshd
19037  sshd                      1    96         0   5700K   1216K      select     0:00     0.00%    sshd

{master:0}
root@TEST> Jan 12 21:31:16 TEST sshd[19039]: Failed password for from 10.130.35.3 port 1801 ssh2 < Session Failed (Session 4)


{master:0}
root@TEST> show system processes extensive | match sshd
PID        USERNAME   THR  PRI   NICE   SIZE       RES        STATE    TIME     WCPU   COMMAND
19039   root                         1      4          0   5860K   2328K     sbwait    0:00       2.15%    sshd
19040   sshd                       1    96          0   5700K   1216K     select     0:00      0.27%    sshd
18029   root                         1    96          0   7068K   2404K     select      0:00     0.00%     sshd
19036   root                         1      4          0   5860K   2328K     sbwait     0:00     0.00%     sshd
19033   root                         1      4          0   5860K   2328K     sbwait     0:00     0.00%     sshd
19034   sshd                      1     96         0   5700K   1216K     select      0:00     0.00%     sshd
19037   sshd                      1     96         0   5700K   1216K     select      0:00     0.00%     sshd

Jan 12 21:31:23 TEST inetd[734]: Number of ssh connections at max limit (5)                                  < ========= Connection Limit Reached
Jan 12 21:31:25 TEST sshd[19042]: Failed password for from 10.130.35.3 port 1803 ssh2  < Session Failed (Session 5)


{master:0}
root@TEST> show system processes extensive | match sshd
PID        USERNAME   THR  PRI   NICE   SIZE       RES       STATE   TIME   WCPU   COMMAND
19042   root                        1       4          0   5860K   2328K   sbwait    0:00    1.13%    sshd
18029   root                        1     96          0   7068K   2404K   select    0:00     0.00%    sshd
19039   root                        1       4          0   5860K   2328K   sbwait   0:00     0.00%    sshd
19036   root                        1       4          0   5860K   2328K   sbwait   0:00     0.00%    sshd
19033   root                        1       4          0   5860K   2328K   sbwait   0:00     0.00%    sshd
19040   sshd                      1    96          0   5700K   1216K   select    0:00     0.00%    sshd
19034   sshd                      1    96          0   5700K   1216K   select    0:00     0.00%    sshd
19043   sshd                      1    96          0   5700K   1216K   select    0:00     0.00%    sshd
19037   sshd                      1    96          0   5700K   1216K   select    0:00     0.00%    sshd


Jan 12 21:32:08 TEST inetd[734]: Number of ssh connections at max limit (5) < Session Failed (Session 6) due to Maximum Limit Reached

Jan 12 21:32:18 TEST inetd[734]: /usr/sbin/sshd[19045]: exited, status 255  < Session Closed (Session 6)

Jan 12 21:32:08 TEST inetd[734]: /usr/sbin/sshd[19036]: exited, status 255  < Session Closed (Session 3)
Jan 12 21:32:18 TEST inetd[734]: /usr/sbin/sshd[19042]: exited, status 255  < Session Closed (Session 5)
Jan 12 21:32:18 TEST inetd[734]: /usr/sbin/sshd[19039]: exited, status 255  < Session Closed (Session 4)
Jan 12 21:32:18 TEST inetd[734]: /usr/sbin/sshd[19033]: exited, status 255  < Session Closed (Session 2)

{master:0}
root@TEST> show system processes extensive | match sshd
PID       USERNAME  THR   PRI  NICE  SIZE       RES      STATE   TIME    WCPU   COMMAND
18029  root                        1    96         0   7068K   2404K   select    0:01     0.00%    sshd
In the output of show system process extensive | match sshd , if the State field is sbwait , then this is not a complete session.

Related Information