TMA-GCP-FIREWALL-NO-RDP-FROM-INTERNET
Ensure RDP access is restricted from the Internet
Deskripsi
Firewall rules allowing RDP (3389) from 0.0.0.0/0 or ::/0 expose every targeted VM to brute force. No enabled INGRESS rule may allow tcp/udp port 3389 (or all) from those ranges. Read-only gcloud calls against the active project (gcloud config set project, or CLOUDSDK_CORE_PROJECT); credentials come from the SDK's normal configuration (gcloud auth login, a service account or ADC). A missing CLI, credential or disabled API fails the check.
Cara pemeriksaan
Metode audit: Perintah shell
out=$(gcloud compute firewall-rules list --format='value(name,direction,disabled,sourceRanges.list(),allowed[].map().firewall_rule().list())' 2>/dev/null) || exit 1
printf '%s\n' "$out" | awk -F '\t' -v p=3389 '
function hit(s, n, i, a, b, m, pr) { n = split(s, a, ","); pr = ""; for (i = 1; i <= n; i++) { m = a[i]; if (m ~ /^[a-z]/) { pr = m; sub(/:.*/, "", pr); if (m !~ /:/) { if (pr == "all" || pr == "tcp" || pr == "udp") return 1; continue } sub(/^[^:]*:/, "", m) } if (pr != "tcp" && pr != "udp") continue; if (split(m, b, "-") == 2) { if (p >= b[1] + 0 && p <= b[2] + 0) return 1 } else if (m + 0 == p) return 1 } return 0 }
NF && $2 == "INGRESS" && $3 != "True" && ("," $4 ",") ~ /,(0\.0\.0\.0\/0|::\/0),/ && hit($5) { n++; print "open: " $1 }
END { if (!n) print "compliant" }'- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Restrict the listed rules to specific source ranges (gcloud compute firewall-rules update <rule> --source-ranges=<cidrs>) or delete them; use IAP TCP forwarding (35.235.240.0/20) for RDP instead.
Properti
- Sistem operasi
- Apa saja
- Tag
- gcpnetwork
- Referensi
- CIS Google Cloud Platform Foundation Benchmark v5.0.0 - Networking - RDP access restricted from the Internet (verify section number for your release)
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target gcp --level 2