TMA-OCI-2.4

Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389

高レベル 1自動oci

説明

Network security groups provide stateful filtering of ingress/egress network traffic to OCI resources. It is recommended that no security group allows unrestricted ingress access to port 3389. Removing unfettered connectivity to remote console services, such as Remote Desktop Protocol (RDP), reduces a server's exposure to risk. Flags network security groups with an INGRESS rule from 0.0.0.0/0 covering port 3389. Covers every subscribed region and every accessible compartment. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

チェック方法

監査方法: シェルコマンド

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
rs=$(oci iam region-subscription list --tenancy-id "$t" --query 'data[?status==`"READY"`]."region-name"' --raw-output 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$rs" | grep -o '"[a-z0-9-]*"' | tr -d '"')
[ -n "$regions" ] || exit 1
for r in $regions; do
  for c in $comps; do
    ns=$(oci network nsg list --compartment-id "$c" --region "$r" --all --query 'data[?"lifecycle-state"==`"AVAILABLE"`].id' --raw-output 2>/dev/null) || exit 1
    for g in $(printf '%s\n' "$ns" | grep -o 'ocid1\.networksecuritygroup\.[^"]*'); do
      n=$(oci network nsg rules list --nsg-id "$g" --region "$r" --all --query 'length(data[?direction==`"INGRESS"` && (source==`"0.0.0.0/0"`) && (protocol==`"all"` || (protocol==`"6"` && ("tcp-options"."destination-port-range"==`null` || ("tcp-options"."destination-port-range".min<=`3389` && "tcp-options"."destination-port-range".max>=`3389`))) || (protocol==`"17"` && ("udp-options"."destination-port-range"==`null` || ("udp-options"."destination-port-range".min<=`3389` && "udp-options"."destination-port-range".max>=`3389`))))])' --raw-output 2>/dev/null) || exit 1
      [ "${n:-0}" -eq 0 ] || { echo "port 3389 open to 0.0.0.0/0: $r $g"; bad=1; }
    done
  done
done
[ "$bad" -eq 0 ] && echo compliant

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remove or narrow the offending NSG rules (oci network nsg rules remove / update --nsg-id <ocid> ...) so 0.0.0.0/0 cannot reach port 3389.

プロパティ

オペレーティングシステム: すべて
タグ: ocinetwork
参照: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 2.4 Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target oci