> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Open smbotcp remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration "Windows SMB Port Should Not Be Open" for GCP using GCP console, follow the below steps: 1. Open the Google Cloud Console and select the project for which you want to remediate the misconfiguration. 2. Navigate to the Compute Engine section and select the VM instance that has the open Windows SMB port. 3. Click on the Edit button at the top of the page. 4. Scroll down to the Firewall section and click on "Add Firewall Rule". 5. In the Name field, enter a name for the firewall rule. 6. In the Targets field, select "Specified target tags" and enter the tag that is associated with the VM instance. 7. In the Source filter field, select "IP ranges" and enter the IP range that you want to allow access to the Windows SMB port. 8. In the Protocols and ports field, select "Specified protocols and ports" and enter "tcp:445". 9. Click on the "Create" button to create the firewall rule. 10. Once the firewall rule is created, click on the Save button to save the changes to the VM instance. 11. Verify that the Windows SMB port is no longer open by running a port scan on the VM instance. By following the above steps, you can remediate the misconfiguration "Windows SMB Port Should Not Be Open" for GCP using GCP console. # To remediate the misconfiguration "Windows SMB Port Should Not Be Open" for GCP using GCP CLI, you can follow these steps: 1. Login to your GCP console using your credentials. 2. Open the Cloud Shell by clicking on the icon located on the top right corner of the console. 3. Run the following command to list all the instances in your project: ``` gcloud compute instances list ``` 4. Identify the instance which has the open SMB port. 5. Run the following command to SSH into the instance: ``` gcloud compute ssh [INSTANCE_NAME] ``` 6. Once you are logged in to the instance, run the following command to check if the SMB port is open: ``` sudo netstat -tuln | grep 445 ``` 7. If the SMB port is open, run the following command to stop the SMB service: ``` sudo systemctl stop smbd ``` 8. Run the following command to disable the SMB service from starting on boot: ``` sudo systemctl disable smbd ``` 9. Finally, run the following command to confirm that the SMB port is no longer open: ``` sudo netstat -tuln | grep 445 ``` 10. Exit the SSH session by running the following command: ``` exit ``` By following these steps, you will have successfully remediated the misconfiguration "Windows SMB Port Should Not Be Open" for GCP using GCP CLI. To remediate the misconfiguration "Windows SMB Port Should Not Be Open" on GCP using Python, you can follow the below steps: 1. Use the Google Cloud SDK to authenticate and authorize access to your GCP account. 2. Use the Python `google-cloud-compute` library to create a new firewall rule that blocks the Windows SMB port (TCP port 445) on all instances in your GCP project. 3. Here is the sample Python code to create a new firewall rule: ```python theme={null} from google.cloud import compute_v1 # Create a compute client compute_client = compute_v1.InstancesClient() # Get the project ID and zone project_id = 'your-project-id' zone = 'us-central1-a' # Define the firewall rule firewall_rule = { "name": "block-smb", "direction": "INGRESS", "priority": 1000, "targetTags": ["windows"], "allowed": [], "denied": [ { "IPProtocol": "tcp", "ports": ["445"] } ], "sourceRanges": ["0.0.0.0/0"], } # Create the firewall rule operation = compute_client.insert_firewall(project=project_id, firewall_resource=firewall_rule) result = operation.result() ``` 4. In the above code, replace `your-project-id` with your GCP project ID and `us-central1-a` with your preferred zone. 5. The above code creates a new firewall rule named "block-smb" that blocks TCP port 445 on all instances with the tag "windows". You can add this tag to your Windows instances to apply the firewall rule. 6. After running the above code, you should see a new firewall rule named "block-smb" in your GCP console. 7. Verify that the firewall rule is working as expected by testing the Windows SMB port from outside your GCP network. By following the above steps, you can remediate the misconfiguration "Windows SMB Port Should Not Be Open" on GCP using Python. ```hcl theme={null} resource "google_compute_firewall" "restrict_smb_445" { name = "restrict-smb-445" network = "projects/PROJECT_ID/global/networks/NETWORK_NAME" # replace PROJECT_ID and NETWORK_NAME direction = "INGRESS" # Replace with the specific trusted CIDR(s) that are allowed SMB access. # Example: ["203.0.113.10/32", "198.51.100.0/24"] source_ranges = [ "TRUSTED_CIDR_1", "TRUSTED_CIDR_2", ] allow { protocol = "tcp" ports = ["445"] } priority = 1000 target_tags = ["SMB_TARGET_TAG"] # replace with instance network tag(s) that should receive SMB } ``` If you currently have another `google_compute_firewall` rule that allows `tcp:445` from `0.0.0.0/0` (or very broad ranges), either: * tighten its `source_ranges` to only trusted CIDRs as above, or * remove that broad rule and attach tags so only the tagged instances are affected by this restricted rule. Changing `source_ranges`, `allow.ports`, or `target_tags` on an existing `google_compute_firewall` is an in‑place update and does not force resource replacement. For verification, `terraform plan` should show: * removal or modification of any firewall rule that allows `tcp:445` from `0.0.0.0/0` (or other public ranges), and * creation or update of a rule where `allow { protocol = "tcp", ports = ["445"] }` is scoped only to your specified trusted `source_ranges`.