🛡️ Google GCE Network allows unrestricted SSH traffic🟢
- Contextual name: 🛡️ GCE Network allows unrestricted SSH traffic🟢
- ID:
/ce/ca/google/vpc/network-ssh-access - Tags:
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Logic
Similar Policies
- Cloud Conformity: Check for Unrestricted SSH Access
Description
Description
This policy identifies Google GCE Networks that have Firewall Rules allowing unrestricted incoming traffic (
0.0.0.0/0) from the internet to the Secure Shell (SSH) port,TCP/22.In GCP, Firewall Rules are defined at the VPC Network level. Each rule either allows or denies traffic based on its configuration. These configurations specify the type of traffic (e.g., protocols and ports) and the source or destination (e.g., IP addresses, subnets, and instances).
Rationale
SSH is the primary protocol for remote administration of Linux-based virtual machines. Exposing the SSH port to the entire internet makes it a persistent target for automated attacks. Malicious actors continuously scan for open port 22 to launch brute-force password attacks, credential stuffing, or exploit known vulnerabilities in SSH daemons. A successful attack can lead to complete compromise of the virtual machine. Access should be restricted to trusted IP addresses, such as a corporate VPN or bastion host, or managed through more secure mechanisms like Google Cloud's Identity-Aware Proxy (IAP).
... see more
Remediation
Remediation
From Google Cloud Console
- Go to
VPC Network.- Go to the
Firewall Rules.- Click the
Firewall Ruleto be modified.- Click
Edit.- Modify
Source IP rangesto specificIP.- Click
Save.From Google Cloud CLI
Identify Firewall Rules Allowing Public Access
gcloud compute networks get-effective-firewalls default \
--format="table(NAME, DIRECTION, IP_RANGES)" \
--filter="IP_RANGES:0.0.0.0/0 AND DIRECTION:INGRESS"Restrict the Source Range
Once you have identified the firewall rules, update each one to restrict access to trusted CIDR ranges:
gcloud compute firewall-rules update {{firewall-rule-name}} \
--source-ranges={{cidr-range1}},{{cidr-range2}}