SSH is exposed to the Internet This product is not supported for your selected
Datadog site . (
).
Id: terraform-azure-ssh-is-exposed-to-the-internet
Provider: Azure
Platform: Terraform
Severity: Medium
Category: Networking and Firewall
Learn More Description Allowing inbound access to port 22 (SSH) from any source address (for example, source_address_prefix = "*", source_address_prefix = "/0", or source_address_prefix = "internet") exposes the server to the public internet, making it highly susceptible to brute force attacks and unauthorized access. If left unaddressed, this misconfiguration significantly increases the risk of remote compromise and could result in full administrative control by attackers. To mitigate this risk, restrict SSH access to specific trusted IP addresses and deny all others. For example:
resource "azurerm_network_security_rule" "secure_ssh" {
name = "restrict_ssh"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "22"
source_address_prefix = "203.0.113.0/24" // Replace with a trusted IP range
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group.example.name
network_security_group_name = azurerm_network_security_group.example.name
}
Compliant Code Examples resource "azurerm_network_security_rule" "negative1" {
name = "example"
priority = 100
direction = "Inbound"
access = "Deny"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "22"
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative2" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "UDP"
source_port_range = "*"
destination_port_range = "20-50"
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative3" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "30-50"
source_address_prefix = "0.0.0.0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative4" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "20-50"
source_address_prefix = "192.168.0.0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative5" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "22"
source_address_prefix = "/1"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative6" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "21"
source_address_prefix = "/0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative7" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "UDP"
source_port_range = "*"
destination_port_range = "22"
source_address_prefix = "internet"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative8" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "21, 23,10-20"
source_address_prefix = "any"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative9" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "UDP"
source_port_range = "*"
destination_port_range = "22"
source_address_prefix = "/0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative10" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "22 , 23"
source_address_prefix = "0.0.1.0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative11" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "220,230"
source_address_prefix = "0.0.0.0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
Non-Compliant Code Examples resource "azurerm_network_security_rule" "positive1" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "22"
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive2" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "22-23"
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive3" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "21-53"
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive4" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "22"
source_address_prefix = "0.0.0.0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive5" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "22,24"
source_address_prefix = "34.15.11.3/0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive6" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "22"
source_address_prefix = "/0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive7" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "21-24, 230"
source_address_prefix = "internet"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive8" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "21, 22 , 24 "
source_address_prefix = "any"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive9" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "21, 22-23,2250"
source_address_prefix = "/0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive10" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "111-211, 20-30, 1-2 , 3"
source_address_prefix = "internet"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
