> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Open smtp remediation ### Triage and Remediation ### Remediation To remediate the SMTP Port Should Not Be Open misconfiguration in GCP using the GCP console, follow these steps: 1. Log in to the GCP console ([https://console.cloud.google.com/](https://console.cloud.google.com/)). 2. Navigate to the Cloud Console. 3. Select the project where the VM instance is running. 4. In the left-hand menu, click on "Compute Engine" and then "VM instances". 5. Locate the instance that has the open SMTP port and click on the name of the instance. 6. In the details pane, click on the "Edit" button at the top of the page. 7. Scroll down to the "Firewall" section and click on "Networking interfaces". 8. Locate the "default-allow-smtp" rule and click on the trash icon to delete the rule. 9. Click on the "Save" button at the bottom of the page to apply the changes. Once you have completed these steps, the SMTP port should no longer be open on the VM instance. # To remediate the "SMTP Port Should Not Be Open" misconfiguration in GCP using GCP CLI, you can follow these steps: 1. Open the Cloud Shell in your GCP Console. 2. Run the following command to list all the firewall rules in your project: `gcloud compute firewall-rules list` 3. Identify the firewall rule that allows SMTP traffic. You can look for a rule that has a target tag that allows SMTP traffic, such as "allow-smtp". 4. Run the following command to delete the firewall rule: `gcloud compute firewall-rules delete [FIREWALL_RULE_NAME]` Replace \[FIREWALL\_RULE\_NAME] with the name of the firewall rule that allows SMTP traffic. 5. Confirm the deletion by typing "y" and pressing enter. 6. Verify that the firewall rule has been deleted by running the following command: `gcloud compute firewall-rules list` You should no longer see the firewall rule that allows SMTP traffic. By following these steps, you have successfully remediated the "SMTP Port Should Not Be Open" misconfiguration in GCP using GCP CLI. To remediate the SMTP Port Should Not Be Open misconfiguration in GCP using Python, follow the below steps: 1. First, you need to identify the instance(s) in your GCP project that has SMTP Port open. You can use the following command in the Cloud Shell to list all the instances in your project: ``` gcloud compute instances list ``` 2. Once you have identified the instance(s) with open SMTP Port, you need to connect to the instance(s) using SSH. You can use the following command to connect to an instance: ``` gcloud compute ssh [INSTANCE_NAME] ``` 3. After you have connected to the instance, you need to check if the SMTP service is running. You can use the following command to check the status of the SMTP service: ``` sudo systemctl status postfix ``` 4. If the SMTP service is running, you need to stop it using the following command: ``` sudo systemctl stop postfix ``` 5. After stopping the SMTP service, you need to disable it so that it does not start automatically on system startup. You can use the following command to disable the SMTP service: ``` sudo systemctl disable postfix ``` 6. Finally, you need to close the SMTP port by modifying the firewall rules. You can use the following command to close the SMTP port: ``` gcloud compute firewall-rules update [FIREWALL_RULE_NAME] --action deny --rules tcp:25 ``` Replace \[FIREWALL\_RULE\_NAME] with the name of the firewall rule that allows SMTP traffic. 7. Once you have completed the above steps, you can exit the SSH session using the following command: ``` exit ``` By following the above steps, you can remediate the SMTP Port Should Not Be Open misconfiguration in GCP using Python. ```hcl theme={null} resource "google_compute_firewall" "smtp_restricted" { name = "REPLACE_WITH_FIREWALL_RULE_NAME" network = "projects/REPLACE_WITH_PROJECT_ID/global/networks/REPLACE_WITH_VPC_NAME" # Restrict SMTP (TCP/25) to known IPs instead of 0.0.0.0/0 direction = "INGRESS" # Replace with the specific trusted CIDR blocks or IPs that should be # allowed to reach SMTP, for example your mail relay or on-prem IPs. source_ranges = [ "REPLACE_WITH_TRUSTED_CIDR_1", # e.g. "203.0.113.10/32" "REPLACE_WITH_TRUSTED_CIDR_2", ] allows { protocol = "tcp" ports = ["25"] } target_tags = ["REPLACE_WITH_TARGET_TAG_IF_USED"] # or remove if not using tags disabled = false priority = 1000 description = "Allow SMTP (TCP/25) only from trusted IP ranges" } ``` Substitute: * `REPLACE_WITH_FIREWALL_RULE_NAME` with the existing firewall rule’s name (or create a new rule and remove/disable the old one that allows `0.0.0.0/0` on port 25). * `REPLACE_WITH_PROJECT_ID` and `REPLACE_WITH_VPC_NAME` with your project and VPC. * `REPLACE_WITH_TRUSTED_CIDR_*` with the exact trusted IP/CIDR ranges. * `REPLACE_WITH_TARGET_TAG_IF_USED` with the instance network tag, or remove `target_tags` if you’re using `target_service_accounts` or applying to all instances. This change updates the existing firewall rule in place (no resource replacement in Terraform terms, but traffic from 0.0.0.0/0 to TCP/25 will be blocked once applied, which can interrupt unauthorised SMTP clients). Verification: `terraform plan` should show that the `source_ranges` for the relevant `google_compute_firewall` no longer include `0.0.0.0/0` and only contain your trusted CIDR blocks.