Ensure That SSH Access Is Restricted From the Internet

Trung bìnhCấp 2Xem xét thủ cônggcp

Mô tả

GCP Firewall Rules are specific to a VPC Network. Each rule either allows or denies traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances. Firewall rules are defined at the VPC network level and are specific to the network in which they are defined. The rules themselves cannot be shared among networks. Firewall rules only support IPv4 traffic. When specifying a source for an ingress rule or a destination for an egress rule by address, only an IPv4 address or IPv4 block in CIDR notation can be used. Generic (0.0.0.0/0) incoming traffic from the internet to VPC or VM instance using SSH on Port 22 can be avoided. GCP Firewall Rules within a VPC Network apply to outgoing (egress) traffic from instances and incoming (ingress)...

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

From Google Cloud Console 1. Go to VPC network. 2. Go to the Firewall Rules. 3. Ensure that Port is not equal to 22 and Action is not set to Allow. 4. Ensure IP Ranges is not equal to 0.0.0.0/0 under Source filters. From Google Cloud CLI gcloud compute firewall-rules list -- format=table'(name,direction,sourceRanges,allowed)' Ensure that there is no rule matching the below criteria: - SOURCE_RANGES is 0.0.0.0/0 - AND DIRECTION is INGRESS - AND IPProtocol is tcp or ALL - AND PORTS is set to 22 or range containing 22 or Null (not set) Note: - When ALL TCP ports are allowed in a rule, PORT does not have any value set (NULL) - When ALL Protocols are allowed in a rule, PORT does not have any value set (NULL)

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

From Google Cloud Console 1. Go to VPC Network. 2. Go to the Firewall Rules. 3. Click the Firewall Rule you want to modify. 4. Click Edit. 5. Modify Source IP ranges to specific IP. 6. Click Save. From Google Cloud CLI 1.Update the Firewall rule with the new SOURCE_RANGE from the below command: gcloud compute firewall-rules update FirewallName --allow=[PROTOCOL[:PORT[- PORT]],...] --source-ranges=[CIDR_RANGE,...]

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: access-controlcloudgcpssh
Tham chiếu: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - 3.6 Ensure That SSH Access Is Restricted From the Internet