KB Article | Forcepoint Support

Problem Description

The required settings to display the SSH login banner follow generic Linux sshd_config file syntax and configuration. But since the relevant filesystem is in read-only mode in the NGFW, the sshd_config and login banner cannot be edited and added directly in /etc/ssh/ directory.

SSH server and its configuration file are updated to a newer version in NGFW engine v6.3.0. If you have customized SSH server configuration file /data/config/ssh/sshd_config, upgrading may not be able to correctly update configuration file preventing login through SSH.

Resolution

Note Perform the following steps on the engine command line.

Add a login banner to be displayed for SSH connections to the NGFW engine:
  1. After upgrading to NGFW engine v6.3.0 customized sshd_config file should be replaced by template and customization should be completed again. ​
    1. cd /data/config/ssh
Important Before deleting the file, create a copy of the existing sshd_config to be able to return previous customization settings.
  1. cp sshd_config /data/home/root/sshd_config.bak
  2. rm sshd_config
  3. cp /usr/share/stonegate/sshd_config /data/config/ssh/sshd_config
  1. Create the file that contains the banner, and add the text that should be displayed at logins. The file is added to a writable filesystem such as /data/home/root/. The content is presented to anyone trying to access the engine command line over SSH. You may use the following example nano command on the engine to create and edit the file. With nano, press CTRL+O and CTRL+X to save the file and exit the editor.
nano /data/home/root/sshd-banner
  1. Edit the configuration file of the SSH server and add the "Banner" setting to it.
nano /data/config/ssh/sshd_config
  1. Add the below line to the end of the server configuration file:
Banner /data/home/root/sshd-banner
  1. Once the file is saved, restart the ssh server daemon with the two commands below:
    1. msvc -d sshd
    2. msvc -u sshd

Article Feedback



Thank you for the feedback and comments.