Skip to main content

GCP CIFS Port Should Not Be Open

More Info:​

Determines if UDP port 445 for CIFS is open to the public

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • FedRAMP
  • GDPR
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the CIFS Port Should Not Be Open misconfiguration for GCP using GCP console, follow these steps:

  1. Log in to the GCP console.
  2. Navigate to the Compute Engine section.
  3. Select the VM instance that has the CIFS port open.
  4. Click on the Edit button at the top of the page.
  5. Scroll down to the Firewall section.
  6. Find the rule that allows traffic on port 445 (CIFS).
  7. Click on the trash can icon to delete the rule.
  8. Click on the Save button at the bottom of the page.

Once you have completed these steps, the CIFS port will no longer be open on the VM instance, and the misconfiguration will be remediated.

Using CLI

The CIFS (Common Internet File System) port should not be open in order to prevent unauthorized access to your GCP resources. To remediate this misconfiguration for GCP using GCP CLI, you can follow the below steps:

  1. Open the Cloud Shell by clicking on the terminal icon in the top right corner of the GCP Console.

  2. Run the following command to list all the firewall rules in your project:

    gcloud compute firewall-rules list

  3. Identify the firewall rule that allows traffic on port 445, which is the CIFS port. The rule name may vary depending on your configuration.

  4. Run the following command to delete the firewall rule:

    gcloud compute firewall-rules delete [FIREWALL_RULE_NAME]

    Replace [FIREWALL_RULE_NAME] with the name of the firewall rule that you identified in step 3.

  5. Confirm the deletion by typing "Y" when prompted.

  6. Verify that the firewall rule has been deleted by running the following command:

    gcloud compute firewall-rules list

    You should not see the deleted firewall rule in the list.

By following these steps, you have successfully remediated the misconfiguration of having the CIFS port open in your GCP project.

Using Python

To remediate the misconfiguration "CIFS Port Should Not Be Open" in GCP using Python, you can follow these steps:

  1. Identify the VM instances that have CIFS port open: You can use the Google Cloud SDK command gcloud to list the VM instances and their firewall rules. Run the following command to list all the VM instances in your project:

    gcloud compute instances list

    You can then inspect each VM instance and check if it has any firewall rules that allow CIFS port (TCP port 445). You can use the following command to list the firewall rules for a VM instance:

    gcloud compute firewall-rules list --filter="targetTags=<instance-tag>"

    Replace <instance-tag> with the tag of the VM instance you want to inspect.

  2. Remove the firewall rule that allows CIFS port: Once you have identified the firewall rule that allows CIFS port, you can remove it using the Google Cloud SDK command gcloud. Run the following command to delete a firewall rule:

    gcloud compute firewall-rules delete <firewall-rule-name>

    Replace <firewall-rule-name> with the name of the firewall rule you want to delete.

  3. Automate the remediation process: You can use the Google Cloud SDK and Python to automate the remediation process for all the VM instances in your project. Here's an example Python script that lists all the firewall rules for all the VM instances in your project and deletes the ones that allow CIFS port:

    import subprocess

    # Get the list of VM instances
    instances = subprocess.check_output(['gcloud', 'compute', 'instances', 'list', '--format', 'json'])

    # Loop through each instance and its firewall rules
    for instance in instances:
        instance_name = instance['name']
        firewall_rules = subprocess.check_output(['gcloud', 'compute', 'firewall-rules', 'list', '--filter', f'targetTags={instance_name}', '--format', 'json'])
        for rule in firewall_rules:
            if rule['allowed'] and 'tcp' in rule['allowed'] and '445' in rule['allowed']['tcp']:
                # Delete the firewall rule that allows CIFS port
                subprocess.check_output(['gcloud', 'compute', 'firewall-rules', 'delete', rule['name']])

    You can customize this script to suit your specific needs, such as filtering VM instances by region or project.

Using Terraform
resource "google_compute_firewall" "restrict_cifs_udp_445" {
  name    = "restrict-cifs-udp-445"
  network = google_compute_network.VPC_NETWORK_NAME.self_link
  project = "GCP_PROJECT_ID" # replace with your GCP project ID

  # Only allow from known IPs; remove "0.0.0.0/0" if present in any existing rule
  source_ranges = [
    "KNOWN_TRUSTED_CIDR_1", # e.g. "203.0.113.10/32"
    "KNOWN_TRUSTED_CIDR_2", # e.g. "198.51.100.0/24"
  ]

  direction = "INGRESS"
  priority  = 1000

  allows {
    protocol = "udp"
    ports    = ["445"]
  }

  # Optionally scope this to specific target instances or tags
  # target_tags        = ["TAG_FOR_CIFS_HOSTS"]
  # target_service_accounts = ["SERVICE_ACCOUNT_EMAIL"]
}

Replace:

  • VPC_NETWORK_NAME with the Terraform resource name of your VPC network (or use a literal self_link/URL).
  • GCP_PROJECT_ID with your GCP project ID.
  • KNOWN_TRUSTED_CIDR_1 / KNOWN_TRUSTED_CIDR_2 with the IP/CIDR ranges that are allowed to access CIFS over UDP 445.

If you already have a google_compute_firewall rule that allows udp port 445 from 0.0.0.0/0, modify that existing resource instead of adding a new one, changing its source_ranges to the trusted CIDRs and ensuring 0.0.0.0/0 is removed. This change updates the rule in place and does not force resource replacement.

Verification: terraform plan should show the existing firewall rule’s source_ranges changing from ["0.0.0.0/0"] (or other broad ranges) to only the specified trusted CIDR blocks, with protocol udp and port 445 remaining allowed.

Additional Reading:​