TMA-GCP-FIREWALL-NO-SSH-FROM-INTERNET
Ensure SSH access is restricted from the Internet
Beschreibung
Firewall rules allowing SSH (22) from 0.0.0.0/0 or ::/0 expose every targeted VM to brute force. No enabled INGRESS rule may allow tcp/udp port 22 (or all) from those ranges. Read-only gcloud calls against the active project (gcloud config set project, or CLOUDSDK_CORE_PROJECT); credentials come from the SDK's normal configuration (gcloud auth login, a service account or ADC). A missing CLI, credential or disabled API fails the check.
So wird geprüft
Prüfmethode: Shell-Befehl
out=$(gcloud compute firewall-rules list --format='value(name,direction,disabled,sourceRanges.list(),allowed[].map().firewall_rule().list())' 2>/dev/null) || exit 1
printf '%s\n' "$out" | awk -F '\t' -v p=22 '
function hit(s, n, i, a, b, m, pr) { n = split(s, a, ","); pr = ""; for (i = 1; i <= n; i++) { m = a[i]; if (m ~ /^[a-z]/) { pr = m; sub(/:.*/, "", pr); if (m !~ /:/) { if (pr == "all" || pr == "tcp" || pr == "udp") return 1; continue } sub(/^[^:]*:/, "", m) } if (pr != "tcp" && pr != "udp") continue; if (split(m, b, "-") == 2) { if (p >= b[1] + 0 && p <= b[2] + 0) return 1 } else if (m + 0 == p) return 1 } return 0 }
NF && $2 == "INGRESS" && $3 != "True" && ("," $4 ",") ~ /,(0\.0\.0\.0\/0|::\/0),/ && hit($5) { n++; print "open: " $1 }
END { if (!n) print "compliant" }'- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Restrict the listed rules to specific source ranges (gcloud compute firewall-rules update <rule> --source-ranges=<cidrs>) or delete them; use IAP TCP forwarding (35.235.240.0/20) for SSH instead.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- gcpnetwork
- Referenz
- CIS Google Cloud Platform Foundation Benchmark v5.0.0 - Networking - SSH access restricted from the Internet (verify section number for your release)
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target gcp --level 2