Password Spraying blocking. Even with WAF and nfa...
# citrix-netscalerj
Jeff Riechers
12/16/2024, 2:23 PMPassword Spraying blocking. Even with WAF and nfactor, clients are still getting hit with password spraying attacks.
1. Make sure you have NetScaler console setup to gather warning syslogs from Netscalers and Gateway Insight for Failed Authentication attempts.
2. If the client has Premium licensing, enable IPRep. but use mine instead of Citrix's as it logs it and provides you data sets to allow and block ip addresses as needed. You can bind the app firewall manually to services if you don't want them global. https://www.jeffriechers.com/wiki/easy-ip-reputation-configuration/
3. If they don't have premium, you can use the allow list and block list from my iprep to manually block out ips that are hammering.
4. Also if they don't have premium, use geo location to block out countries that don't need to login to Gateway. https://www.jeffriechers.com/wiki/block-non-us-and-canada-sites-from-vservers/
5. Enable Gateway WAF and Security Insite (if premium) on the AAA parameters settings on the firmware.
đź‘€ 1
🙏 1
j
Julian Jakob
12/17/2024, 11:48 AMThanks Jeff. In addition, also a further method from Steven https://community.citrix.com/tech-zone/build/tech-papers/detecting-and-mitigating-password-spraying-attacks-nsg
j
Jeff Riechers
12/17/2024, 12:28 PMYeah, that looks pretty cool. I am going to test that out at some clients.
Jeff Riechers
12/17/2024, 12:28 PMI had one client whose firewalls were doing some form of IP Reputation, but they have a far less restrictive vendor than Brightcloud, because they were letting through a LOT of bad actors.
j
Joost Sannen
12/19/2024, 3:04 PMThanks for your easy IP reputation configuration Jeff.
I used this for IPv6 too and used a different audit message. Any idea why the IPv6 policy states a IPv4 address is malicious?
default APPFW Message 213136 0 : “10.x.x.x was dropped because the IPv6 address is listed in either the IPREP Database or is on the NetScaler Blocklist”
Joost Sannen
12/19/2024, 3:32 PMI’m sure it’s not on the IPv4 or IPv6 blocklist
Joost Sannen
12/19/2024, 3:35 PMenable ns feature rep appfwadd policy dataset Allow_IPREP_list_ipv4 ipv4add policy dataset Block_IPREP_list_ipv4 ipv4add policy dataset Allow_IPREP_list_ipv6 ipv6add policy dataset Block_IPREP_list_ipv6 ipv6add audit messageaction IPREP_OR_BLOCKLIST_ipv4 WARNING "CLIENT.IP.SRC + \" was dropped because the IPv4 address is listed in either the IPREP Database or is on the NetScaler Blocklist\"" -logtoNewnslog YESadd appfw policy IPREP_ipv4_pol "((CLIENT.IP.SRC.IPREP_IS_MALICIOUS || CLIENT.IP.SRC.TYPECAST_TEXT_T.CONTAINS_ANY(\"Block_IPREP_list_ipv4\")) && ! (CLIENT.IP.SRC.TYPECAST_TEXT_T.CONTAINS_ANY(\"Allow_IPREP_list_ipv4\")))" APPFW_BLOCK -logAction IPREP_OR_BLOCKLIST_ipv4bind appfw global IPREP_ipv4_pol 100 END -type REQ_DEFAULTadd audit messageaction IPREP_OR_BLOCKLIST_ipv6 WARNING "CLIENT.IPV6.SRC + \" was dropped because the IPv6 address is listed in either the IPREP Database or is on the NetScaler Blocklist\"" -logtoNewnslog YESadd appfw policy IPREP_ipv6_pol "((CLIENT.IPV6.SRC.IPREP_IS_MALICIOUS || CLIENT.IPV6.SRC.TYPECAST_TEXT_T.CONTAINS_ANY(\"Block_IPREP_list_ipv6\")) && ! (CLIENT.IPV6.SRC.TYPECAST_TEXT_T.CONTAINS_ANY(\"Allow_IPREP_list_ipv6\")))" APPFW_BLOCK -logAction IPREP_OR_BLOCKLIST_ipv6bind appfw global IPREP_ipv6_pol 110 END -type REQ_DEFAULTs
stucker78 (stucker78)
12/26/2024, 3:57 PMQuestion for the group: Will I need to change my NS Config if all are in play - Netscalers are not external facing - Use FAS / Pin+SecurID for authentication ? Thanks in advance ...
a
Arthur
01/03/2025, 5:51 PMWhat’s the best way to setup e-mail notifications for 1 on specific threshold for example 200 failed authentications per 1h ?
j
Jeff Riechers
01/05/2025, 3:52 PMI am starting to build up ranges of compromised internet provider devices that are taking part in the password spraying attacks. Is anyone else maintaining any form of lists like this for Block listing?
Jeff Riechers
01/06/2025, 2:32 PMJeff Riechers
01/06/2025, 2:32 PMI have updated my document with additional methods to block, and detect attacks with NetScaler Console.
a
Arthur
01/06/2025, 2:33 PMWhat about notifications?
j
Jeff Riechers
01/06/2025, 2:34 PMStill working on that. NetScaler Console doesn't have a good trigger method right now for unknown user alerting.
đź‘Ť 1
đź’Ż 1
Jeff Riechers
01/13/2025, 4:39 PMI updated my documentation on this. Ran into an issue where in some environments the AppFW feature was not triggering for certain subnets. Breaking them out to responder policies seems to work correctly. Also I included some hostname validation, so if they are attacking just via IP Address it will drop those requests as well. https://www.jeffriechers.com/wiki/easy-ip-reputation-configuration/
đź‘Ť 2