> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Unrestricted ssh access remediation ### Triage and Remediation ### Remediation To remediate the unrestricted SSH access misconfiguration in AWS using the AWS console, you can follow these steps: 1. Log in to the AWS Management Console. 2. Navigate to the EC2 service. 3. Select the EC2 instance(s) that have unrestricted SSH access. 4. Click on the "Actions" button and select "Networking" and then "Change Security Groups". 5. In the "Change Security Groups" window, select the security group associated with the instance(s) and click "Edit". 6. In the "Edit inbound rules" window, locate the SSH rule (port 22) and remove it or restrict it to only allow traffic from specific IP addresses or ranges. 7. Click "Save" to apply the changes. Once you have completed these steps, the unrestricted SSH access misconfiguration will be remediated and the instance(s) will be more secure. # To remediate unrestricted SSH access in AWS using AWS CLI, follow these steps: 1. Open the AWS CLI on your local machine. 2. Run the following command to list all the security groups in your AWS account: ``` aws ec2 describe-security-groups ``` 3. Identify the security group that allows unrestricted SSH access. You can look for a security group that has a rule allowing SSH traffic from 0.0.0.0/0 (any IP address) or ::/0 (any IPv6 address). 4. Once you have identified the security group, note down its Group ID. 5. Run the following command to revoke the SSH access rule from the security group: ``` aws ec2 revoke-security-group-ingress --group-id --protocol tcp --port 22 --cidr 0.0.0.0/0 ``` Replace `` with the Group ID of the security group that allows unrestricted SSH access. 6. Verify that the SSH access rule has been revoked by running the following command: ``` aws ec2 describe-security-groups --group-ids ``` Replace `` with the Group ID of the security group that allows unrestricted SSH access. 7. Repeat the above steps for all the security groups in your AWS account to ensure that SSH access is not allowed from any unauthorized IP addresses. To remediate the unrestricted SSH access issue in AWS using Python, follow these steps: 1. Import the necessary AWS SDKs and libraries in your Python script. You will need to import the `boto3` library to interact with AWS services. ``` import boto3 ``` 2. Create a client session for EC2 using `boto3.client()`. ``` ec2 = boto3.client('ec2') ``` 3. Use the `describe_security_groups()` method to retrieve all the security groups in your AWS account. ``` security_groups = ec2.describe_security_groups() ``` 4. Loop through each security group and check if it has any inbound rules allowing SSH access from any IP address (`0.0.0.0/0`). ``` for sg in security_groups['SecurityGroups']: for rule in sg['IpPermissions']: if rule['IpProtocol'] == 'tcp' and rule['FromPort'] <= 22 and rule['ToPort'] >= 22: for ip_range in rule['IpRanges']: if ip_range['CidrIp'] == '0.0.0.0/0': print(f"Security group {sg['GroupId']} allows unrestricted SSH access.") ``` 5. If any security group is found to have unrestricted SSH access, use the `revoke_security_group_ingress()` method to remove the rule allowing SSH access from any IP address. ``` ec2.revoke_security_group_ingress( GroupId=sg['GroupId'], IpPermissions=[ { 'IpProtocol': 'tcp', 'FromPort': 22, 'ToPort': 22, 'IpRanges': [ { 'CidrIp': '0.0.0.0/0' } ] } ] ) ``` 6. Run the Python script to remediate the unrestricted SSH access issue in your AWS account. Note: Make sure to run the script with appropriate AWS credentials and permissions. ```hcl theme={null} resource "aws_security_group" "ssh_restricted" { name = "SSH_RESTRICTED_SG_NAME" # replace with the security group name description = "Security group without unrestricted SSH" vpc_id = "VPC_ID" # replace with your VPC ID # REMOVE any existing rule that allows: # - from_port = 22, to_port = 22, protocol = "tcp" # with cidr_blocks = ["0.0.0.0/0"] or ipv6_cidr_blocks = ["::/0"] # Example: add a more restrictive SSH rule instead (optional) ingress { description = "SSH from trusted IPv4 address" from_port = 22 to_port = 22 protocol = "tcp" cidr_blocks = ["TRUSTED_IPV4_CIDR"] # e.g. "203.0.113.10/32" } # Example: no wide-open IPv6 SSH rule either; use a restricted prefix if needed # ingress { # description = "SSH from trusted IPv6 range" # from_port = 22 # to_port = 22 # protocol = "tcp" # ipv6_cidr_blocks = ["TRUSTED_IPV6_CIDR"] # e.g. "2001:db8::/64" # } # other (non-SSH) ingress/egress rules as required } ``` This Terraform removes the ingress rules that allow SSH (TCP 22) from `0.0.0.0/0` and `::/0` by no longer defining them, matching the CLI revocations; it does not automatically add any replacement rule unless you configure one as shown. This change updates the security group in place and does not force resource replacement. To verify, `terraform plan` should show: * any existing SSH ingress with `from_port = 22`, `to_port = 22`, `protocol = "tcp"` and `cidr_blocks = ["0.0.0.0/0"]` being destroyed, * and, if you add them, new more-restrictive SSH rules being created.