SSH access is not restricted

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: ansible-gcp-ssh-access-is-not-restricted

Provider: GCP

Platform: Ansible

Severity: Medium

Category: Networking and Firewall

Learn More

Description

Allowing SSH (port 22) from the public Internet exposes instances to brute-force attacks and unauthorized access. This can lead to credential compromise and lateral movement across your network.

In Ansible tasks using the google.cloud.gcp_compute_firewall or gcp_compute_firewall modules, this rule flags ingress rules where source_ranges includes 0.0.0.0/0 or ::/0 and an allowed entry specifies port 22 (for example, allowed[].ip_protocol='tcp' and allowed[].ports contains 22).

Restrict SSH access to specific trusted CIDR ranges, place SSH behind a bastion host or VPN, or use identity-aware access methods instead of allowing unrestricted Internet access.

Secure example restricting SSH to a single admin IP:

- name: allow-ssh-from-admin
  google.cloud.gcp_compute_firewall:
    name: allow-ssh-from-admin
    network: default
    direction: INGRESS
    source_ranges:
      - 203.0.113.5/32
    allowed:
      - ip_protocol: tcp
        ports: ['22']

Compliant Code Examples

- name: ssh_restricted
  google.cloud.gcp_compute_firewall:
    name: test_object
    denied:
    - ip_protocol: tcp
      ports:
      - '22'
    target_tags:
    - test-ssh-server
    - staging-ssh-server
    source_tags:
    - test-ssh-clients
    project: test_project
    auth_kind: serviceaccount
    service_account_file: /tmp/auth.pem
    state: present
    source_ranges:
    - 0.0.0.0

Non-Compliant Code Examples

- name: ssh_unrestricted
  google.cloud.gcp_compute_firewall:
    name: test_object
    allowed:
    - ip_protocol: tcp
      ports:
      - '22'
    target_tags:
    - test-ssh-server
    - staging-ssh-server
    source_tags:
    - test-ssh-clients
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present
    source_ranges:
    - "0.0.0.0/0"