TMA-IBMCLOUD-VPC-SG-NO-ADMIN-FROM-ANY
Ensure no VPC security groups allow inbound 0.0.0.0/0 to port 22 or 3389
Description
SSH and RDP open to the Internet are brute-forced continuously. In the targeted region, no inbound rule of any VPC security group may allow remote 0.0.0.0/0 or ::/0 to tcp 22/3389 or all protocols (requires the vpc-infrastructure plugin). Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.
Méthode de vérification
Méthode d'audit: Commande shell
sgs=$(ibmcloud is security-groups --output json 2>/dev/null) || exit 1
bad=0
for g in $(printf '%s\n' "$sgs" | awk '{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") } d == 1 && /"id"[[:space:]]*:/ { s = $0; sub(/^[^:]*:[[:space:]]*"/, "", s); sub(/".*/, "", s); print s } { d += o - c }'); do
rules=$(ibmcloud is security-group-rules "$g" --output json 2>/dev/null) || exit 1
n=$(printf '%s\n' "$rules" | awk '
function v(s) { sub(/^[^:]*:[[:space:]]*/, "", s); gsub(/[",[:space:]]/, "", s); return s }
{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") }
d == 0 && o > 0 { dir = ""; pr = ""; pmin = ""; pmax = ""; cidr = ""; inr = 0 }
d == 1 && /"remote"[[:space:]]*:/ { inr = 1 }
d == 1 && /"direction"[[:space:]]*:/ { dir = v($0) }
d == 1 && /"protocol"[[:space:]]*:/ { pr = v($0) }
d == 1 && /"port_min"[[:space:]]*:/ { pmin = v($0) }
d == 1 && /"port_max"[[:space:]]*:/ { pmax = v($0) }
inr && /"cidr_block"[[:space:]]*:/ { cidr = v($0) }
{ d += o - c }
d == 1 && c > 0 { inr = 0 }
d == 0 && c > 0 { if (dir == "inbound" && (cidr == "0.0.0.0/0" || cidr == "::/0") && (pr == "all" || pr == "tcp") && (pmin == "" || (pmin + 0 <= 22 && pmax + 0 >= 22) || (pmin + 0 <= 3389 && pmax + 0 >= 3389))) n++ }
END { print n + 0 }')
[ "$n" -eq 0 ] || { echo "open admin port: $g"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant- Sortie attendue
compliant
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
ibmcloud is security-group-rule-delete <sg> <rule> (or security-group-rule-update --remote <admin-cidr>) for the offending rules; use a bastion / VPN for administration.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- ibmcloudnetwork
- Référence
- CIS IBM Cloud Foundations Benchmark v2.0.0 - Networking - VPC security groups restrict SSH/RDP from 0.0.0.0/0 (verify section number for your release)
Vérifier cet hôte
Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.
tmaegis scan --target ibmcloud