---
title: Security Group should restrict SSH access from the internet
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Security Group should restrict SSH
  access from the internet
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Security Group should restrict SSH access from the internet
 
## Description{% #description %}

Azure network security groups should restrict SSH access from the internet. Attackers can brute-force or exploit an exposed SSH port to gain access to virtual machines and move within the virtual network.

A network security group fails when an inbound Allow rule opens port 22 to the internet and no higher-priority Deny rule blocks it. This rule treats `*`, `0.0.0.0/0`, `::/0`, `Internet`, and `Any` as internet sources. It counts port ranges that include port 22, and security rules with the TCP, UDP, or Any protocol. It does not evaluate security rules that list multiple source address prefixes, or just-in-time (JIT) access rules created by Microsoft Defender for Cloud.

## Remediation{% #remediation %}

Delete each inbound Allow rule that opens port 22 to the internet, or change its source to specific IP addresses. Use a VPN, ExpressRoute, or Azure Bastion for remote access instead. See [Create, change, or delete Azure network security groups](https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group).

## References{% #references %}

- [Create, change, or delete Azure network security groups](https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group)
- [Azure network security groups overview](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview)
- [az network nsg rule](https://learn.microsoft.com/en-us/cli/azure/network/nsg/rule)
- [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure)