TMA-OCI-2.3

Ensure no network security groups allow ingress from 0.0.0.0/0 to port 22

VisokaNivo 1Automatskaoci

Opis

Network security groups provide stateful filtering of ingress/egress network traffic to OCI resources. It is recommended that no security group allows unrestricted ingress to port 22. Removing unfettered connectivity to remote console services, such as Secure Shell (SSH), reduces a server's exposure to risk. Flags network security groups with an INGRESS rule from 0.0.0.0/0 covering port 22. Covers every subscribed region and every accessible compartment. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Kako se proverava

Metod provere: Komanda ljuske

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
rs=$(oci iam region-subscription list --tenancy-id "$t" --query 'data[?status==`"READY"`]."region-name"' --raw-output 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$rs" | grep -o '"[a-z0-9-]*"' | tr -d '"')
[ -n "$regions" ] || exit 1
for r in $regions; do
  for c in $comps; do
    ns=$(oci network nsg list --compartment-id "$c" --region "$r" --all --query 'data[?"lifecycle-state"==`"AVAILABLE"`].id' --raw-output 2>/dev/null) || exit 1
    for g in $(printf '%s\n' "$ns" | grep -o 'ocid1\.networksecuritygroup\.[^"]*'); do
      n=$(oci network nsg rules list --nsg-id "$g" --region "$r" --all --query 'length(data[?direction==`"INGRESS"` && (source==`"0.0.0.0/0"`) && (protocol==`"all"` || (protocol==`"6"` && ("tcp-options"."destination-port-range"==`null` || ("tcp-options"."destination-port-range".min<=`22` && "tcp-options"."destination-port-range".max>=`22`))) || (protocol==`"17"` && ("udp-options"."destination-port-range"==`null` || ("udp-options"."destination-port-range".min<=`22` && "udp-options"."destination-port-range".max>=`22`))))])' --raw-output 2>/dev/null) || exit 1
      [ "${n:-0}" -eq 0 ] || { echo "port 22 open to 0.0.0.0/0: $r $g"; bad=1; }
    done
  done
done
[ "$bad" -eq 0 ] && echo compliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Remove or narrow the offending NSG rules (oci network nsg rules remove / update --nsg-id <ocid> ...) so 0.0.0.0/0 cannot reach port 22.

Svojstva

Operativni sistemi: Bilo koji
Oznake: ocinetwork
Referenca: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 2.3 Ensure no network security groups allow ingress from 0.0.0.0/0 to port 22

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target oci