SSH Port Should Not Be Open
More Info:
Determines if TCP port 22 for SSH is open to the public.Risk Level
MediumAddress
SecurityCompliance Standards
SOC2, PCIDSS, ISO27001, HIPAA, CISGCP, CBP, HITRUST, GDPR, NISTCSF, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the SSH port open misconfiguration in GCP using the GCP console, follow the below steps:
- Login to the GCP console (https://console.cloud.google.com/).
- Navigate to the Compute Engine section.
- Select the instance where the SSH port is open.
- Click on the “Edit” button at the top of the page.
- Scroll down to the “Firewall” section and click on “Management, security, disks, networking, sole tenancy”.
- Under the “Firewall” section, click on “Networking”.
- In the “Firewall rules” section, find the firewall rule that is allowing SSH access (usually named “default-allow-ssh”).
- Click on the checkbox next to the rule to select it.
- Click on the “Delete” button at the top of the page.
- Confirm the deletion by clicking on the “Delete” button in the confirmation dialog box.
Using CLI
Using CLI
To remediate the SSH port open misconfiguration in GCP using GCP CLI, follow these steps:
- Open the GCP CLI and connect to your project.
-
Run the following command to list all the instances in your project:
- Identify the instance for which you want to remediate the misconfiguration.
-
Run the following command to get the details of the instance:
Replace
[INSTANCE_NAME]with the name of your instance. -
Look for the
metadatasection in the output. If you see assh-keysentry, then SSH port is open. To remediate this, delete thessh-keysentry. -
Run the following command to delete the
ssh-keysentry:Replace[INSTANCE_NAME]with the name of your instance. -
Verify that the
ssh-keysentry has been deleted by running thegcloud compute instances describecommand again.You should not see thessh-keysentry in the output. - Repeat steps 4-7 for all the instances in your project to ensure that SSH port is not open on any of them.
Using Python
Using Python
To remediate the SSH port being open misconfiguration in GCP using Python, you can follow these steps:Note: Replace the zone with the appropriate zone for your instance.Note: This code creates a new firewall rule for each instance to restrict SSH access to specified IP ranges. You can modify the Note: This code removes the default firewall rule that allows SSH access from any IP address.Note: This code lists all the firewall rules in the project and their associated source IP ranges. You should see that the new firewall rules restrict SSH access to specified IP ranges.
- Import the necessary libraries:
- Set up authentication credentials:
- Retrieve the project ID:
- Retrieve the list of instances:
- Loop through the instances and update the firewall rules to restrict SSH access:
sourceRanges parameter to specify the IP ranges that should be allowed to access SSH.- Remove the existing firewall rule that allows SSH access:
- Verify that the firewall rules have been updated: