SSH access is not restricted

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-gcp-ssh-access-is-not-restricted

Provider: GCP

Platform: Ansible

Severity: Medium

Category: Networking and Firewall

Learn More

Description

Allowing SSH (port 22) from the public Internet exposes instances to brute-force attacks and unauthorized access. This can lead to credential compromise and lateral movement across your network.

In Ansible tasks using the google.cloud.gcp_compute_firewall or gcp_compute_firewall modules, this rule flags ingress rules where source_ranges includes 0.0.0.0/0 or ::/0 and an allowed entry specifies port 22 (for example, allowed[].ip_protocol='tcp' and allowed[].ports contains 22).

Restrict SSH access to specific trusted CIDR ranges, place SSH behind a bastion host or VPN, or use identity-aware access methods instead of allowing unrestricted Internet access.

Secure example restricting SSH to a single admin IP:

- name: allow-ssh-from-admin
  google.cloud.gcp_compute_firewall:
    name: allow-ssh-from-admin
    network: default
    direction: INGRESS
    source_ranges:
      - 203.0.113.5/32
    allowed:
      - ip_protocol: tcp
        ports: ['22']

Compliant Code Examples

- name: ssh_restricted
  google.cloud.gcp_compute_firewall:
    name: test_object
    denied:
    - ip_protocol: tcp
      ports:
      - '22'
    target_tags:
    - test-ssh-server
    - staging-ssh-server
    source_tags:
    - test-ssh-clients
    project: test_project
    auth_kind: serviceaccount
    service_account_file: /tmp/auth.pem
    state: present
    source_ranges:
    - 0.0.0.0

Non-Compliant Code Examples

- name: ssh_unrestricted
  google.cloud.gcp_compute_firewall:
    name: test_object
    allowed:
    - ip_protocol: tcp
      ports:
      - '22'
    target_tags:
    - test-ssh-server
    - staging-ssh-server
    source_tags:
    - test-ssh-clients
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present
    source_ranges:
    - "0.0.0.0/0"