CIFS Port Should Not Be Open
More Info:
Determines if UDP port 445 for CIFS is open to the publicRisk Level
MediumAddress
SecurityCompliance Standards
HITRUST, GDPR, SOC2, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the CIFS Port Should Not Be Open misconfiguration for GCP using GCP console, follow these steps:
- Log in to the GCP console.
- Navigate to the Compute Engine section.
- Select the VM instance that has the CIFS port open.
- Click on the Edit button at the top of the page.
- Scroll down to the Firewall section.
- Find the rule that allows traffic on port 445 (CIFS).
- Click on the trash can icon to delete the rule.
- Click on the Save button at the bottom of the page.
Using CLI
Using CLI
The CIFS (Common Internet File System) port should not be open in order to prevent unauthorized access to your GCP resources. To remediate this misconfiguration for GCP using GCP CLI, you can follow the below steps:
- Open the Cloud Shell by clicking on the terminal icon in the top right corner of the GCP Console.
-
Run the following command to list all the firewall rules in your project:
- Identify the firewall rule that allows traffic on port 445, which is the CIFS port. The rule name may vary depending on your configuration.
-
Run the following command to delete the firewall rule:
Replace [FIREWALL_RULE_NAME] with the name of the firewall rule that you identified in step 3.
- Confirm the deletion by typing “Y” when prompted.
-
Verify that the firewall rule has been deleted by running the following command:
You should not see the deleted firewall rule in the list.
Using Python
Using Python
To remediate the misconfiguration “CIFS Port Should Not Be Open” in GCP using Python, you can follow these steps:
-
Identify the VM instances that have CIFS port open: You can use the Google Cloud SDK command
gcloudto list the VM instances and their firewall rules. Run the following command to list all the VM instances in your project:You can then inspect each VM instance and check if it has any firewall rules that allow CIFS port (TCP port 445). You can use the following command to list the firewall rules for a VM instance:Replace<instance-tag>with the tag of the VM instance you want to inspect. -
Remove the firewall rule that allows CIFS port: Once you have identified the firewall rule that allows CIFS port, you can remove it using the Google Cloud SDK command
gcloud. Run the following command to delete a firewall rule:Replace<firewall-rule-name>with the name of the firewall rule you want to delete. -
Automate the remediation process: You can use the Google Cloud SDK and Python to automate the remediation process for all the VM instances in your project. Here’s an example Python script that lists all the firewall rules for all the VM instances in your project and deletes the ones that allow CIFS port:
You can customize this script to suit your specific needs, such as filtering VM instances by region or project.