> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Open vnc client remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "VNC Client Port Should Not Be Open" in GCP using GCP console, follow the below steps:

        1. Login to the GCP console with your credentials.
        2. Navigate to the Compute Engine section from the left-hand side menu.
        3. Click on the name of the instance where you want to remediate the misconfiguration.
        4. Click on the "Edit" button at the top of the page.
        5. Scroll down to the "Firewall" section.
        6. Click on the "default-allow-rdp" rule.
        7. Click on the "Edit" button.
        8. In the "Protocols and ports" section, uncheck the "tcp:3389" checkbox.
        9. Click on the "Save" button to save the changes.
        10. Repeat steps 6-9 for "default-allow-vnc" rule.
        11. Click on the "Save" button at the bottom of the page to save the changes.

        After following the above steps, the VNC Client Port will be closed and the misconfiguration will be remediated.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the VNC Client Port Should Not Be Open misconfiguration in GCP using GCP CLI, follow these steps:

        1. Open the Cloud Shell by clicking the Activate Cloud Shell button in the GCP Console.

        2. Run the following command to list all the firewall rules in your project:

           ```
           gcloud compute firewall-rules list
           ```

        3. Identify the firewall rule that allows traffic to the VNC client port (usually port 5900).

        4. Run the following command to delete the firewall rule:

           ```
           gcloud compute firewall-rules delete [FIREWALL_RULE_NAME]
           ```

           Replace `[FIREWALL_RULE_NAME]` with the name of the firewall rule that allows traffic to the VNC client port.

        5. Verify that the firewall rule has been deleted by running the following command:

           ```
           gcloud compute firewall-rules list
           ```

           The output should not include the firewall rule that allowed traffic to the VNC client port.

        6. You have successfully remediated the VNC Client Port Should Not Be Open misconfiguration in GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the VNC Client Port open misconfiguration in GCP using Python, you can follow these steps:

        1. First, you need to authenticate and authorize your Google Cloud account using the Python client library. You can do this by following the instructions in the official Google Cloud documentation.

        2. Next, you need to identify the GCP project and the specific instance(s) that have the VNC client port open. You can use the `google-cloud-sdk` command-line tool or the Python client library to list all the instances in your project.

        3. Once you have identified the instances with the VNC client port open, you can use the Python client library to update the firewall rules for each instance to block the VNC client port. Here's an example code snippet that uses the `google-cloud-firewall` library to update the firewall rules for an instance:

        ```
        from google.cloud import firewall

        # Replace PROJECT_ID with your GCP project ID
        project_id = 'PROJECT_ID'

        # Replace INSTANCE_NAME with the name of the instance with the VNC client port open
        instance_name = 'INSTANCE_NAME'

        # Replace VNC_CLIENT_PORT with the actual port number (usually 5900)
        vnc_client_port = 5900

        # Create a firewall client object
        firewall_client = firewall.FirewallClient()

        # Get the firewall rules for the instance
        firewall_rules = firewall_client.list(project=project_id)

        # Find the rule that allows traffic to the VNC client port
        vnc_client_rule = None
        for rule in firewall_rules:
            if rule.allowed[0].ports == [str(vnc_client_port)] and \
                    rule.direction == 'INGRESS' and \
                    rule.target_tags == [instance_name]:
                vnc_client_rule = rule
                break

        # If the rule exists, update it to block traffic to the VNC client port
        if vnc_client_rule:
            vnc_client_rule.allowed = []
            firewall_client.update(vnc_client_rule)
        ```

        4. Finally, you can verify that the VNC client port is no longer open by trying to connect to it from a remote machine. If the remediation was successful, the connection should be refused.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_compute_firewall" "vnc_client_restricted" {
          name    = "vnc-client-restricted"
          network = "projects/${PROJECT_ID}/global/networks/${VPC_NETWORK_NAME}"

          direction = "INGRESS"
          priority  = 1000

          # Replace these with the specific IPs or CIDR ranges that are allowed
          source_ranges = [
            "ALLOWED_VNC_ADMIN_IP_CIDR_1", # e.g. "203.0.113.10/32"
            "ALLOWED_VNC_ADMIN_IP_CIDR_2", # e.g. "198.51.100.0/24"
          ]

          # Optionally restrict which instances this applies to
          # target_tags = ["VNC_INSTANCE_TAG"]

          allow {
            protocol = "tcp"
            ports    = ["5500"]
          }

          # Optional: explicitly deny all other source ranges on this port by
          # ensuring there is no other firewall rule allowing tcp:5500 from 0.0.0.0/0.
        }
        ```

        If you are modifying an existing `google_compute_firewall` rule that currently has `source_ranges = ["0.0.0.0/0"]` for `tcp:5500`, update `source_ranges` to the specific trusted CIDR blocks as shown above; this change is in-place and does not force replacement of the firewall rule.

        For verification, `terraform plan` should show the firewall rule’s `source_ranges` changing from `["0.0.0.0/0"]` (or other broad ranges) to the specific `ALLOWED_VNC_ADMIN_IP_CIDR_*` values, with no `create`/`destroy` of the resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>