Securing Client Authentication on a Check Point Gateway
VendorCheck Point
PlatformSPLAT
VersionR65 NGX
Firewalls - Checkpoint
Tuesday, 06 April 2010 12:05

By default Client Authentication allows you to authenticate using HTTP (on port 900) or Telnet (on port 259). Both of which can pose security risks due to the username and passwords being sent un-encrypted.

To secure Client Authenitcation follow the following steps :

Change the following line in $FWDIR/conf/fwauthd.conf,

900     fwssd       in.ahclientd    wait    900
to 
900     fwssd       in.ahclientd    wait    900        ssl:defaultCert
And remove the line : 
259     fwssd       in.aclientd     wait    259
This allows you to change the HTTP server to an encrypted HTTPS server and disables authentication over Telnet.



Related Articles
 
We have 35 guests online