TMA-OCI-2.1

Ensure no security lists allow ingress from 0.0.0.0/0 to port 22

AltaNível 1Automatizadaoci

Descrição

Security lists provide stateful and stateless filtering of ingress and egress network traffic to OCI resources on a subnet level. It is recommended that no security list allows unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as Secure Shell (SSH), reduces a server's exposure to risk. Flags security lists with an ingress rule from 0.0.0.0/0 covering port 22 (TCP/UDP with that port or no port range, or all protocols). Covers every subscribed region and every accessible compartment. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Como é verificado

Método de auditoria: Comando shell

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
rs=$(oci iam region-subscription list --tenancy-id "$t" --query 'data[?status==`"READY"`]."region-name"' --raw-output 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$rs" | grep -o '"[a-z0-9-]*"' | tr -d '"')
[ -n "$regions" ] || exit 1
for r in $regions; do
  for c in $comps; do
    out=$(oci network security-list list --compartment-id "$c" --region "$r" --all --query 'data[?length("ingress-security-rules"[?(source==`"0.0.0.0/0"`) && (protocol==`"all"` || (protocol==`"6"` && ("tcp-options"."destination-port-range"==`null` || ("tcp-options"."destination-port-range".min<=`22` && "tcp-options"."destination-port-range".max>=`22`))) || (protocol==`"17"` && ("udp-options"."destination-port-range"==`null` || ("udp-options"."destination-port-range".min<=`22` && "udp-options"."destination-port-range".max>=`22`))))]) > `0`]."display-name"' --raw-output 2>/dev/null) || exit 1
    printf '%s\n' "$out" | grep -q '"' && { printf '%s\n' "$out" | grep '"' | sed "s|^|$r |"; bad=1; }
  done
done
[ "$bad" -eq 0 ] && echo compliant

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Edit the listed security lists (oci network security-list update --security-list-id <ocid> --ingress-security-rules file://rules.json) so no ingress rule from 0.0.0.0/0 covers port 22; use the OCI Bastion service for administration.

Propriedades

Sistemas operacionais: Qualquer
Tags: ocinetwork
Referência: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 2.1 Ensure no security lists allow ingress from 0.0.0.0/0 to port 22

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target oci