SSH access

[PhieuDieuVoCuc]

Version

2.4.190

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

16

Storage for /

120

Storage for /nsm

120

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,
By default, I see these rules allowing all traffic to the SSH port.
Is SSH necessary for SO to run in distributed mode?
How can I stop blocking SSH traffic directly from the firewall (iptables) or allow access from only certain sources?
I tried deleting the iptables rules manually, but they seem to reconfigure themselves automatically.

Thanks!!!!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

In SOC > Administration > Configuration > firewall > hostgroups > anywhere [advanced toggled on] change that from 0.0.0.0/0 to whatever you want to restrict SSH to.

[PhieuDieuVoCuc]

Thank you!