iCompaas Support

Description:

Security groups are stateful and provide filtering of inbound/ingress network traffic to filtering of inbound/ingress network traffic to AWS resources groups do not allow unrestricted inbound/ingress access to port 20 or 21.

Rationale:

Security groups act as a virtual firewall that controls the traffic for one or more instances. When you launch an instance, you can specify one or more security groups. You can modify the rules for a security group at any time, the new rules are automatically applied to all instances that are associated with the security group. When we decide whether to allow traffic to reach an instance, we evaluate all the rules from all the security groups that are associated with the instance.

Impact:

For Updating an existing environment, care should be taken to ensure that administrators currently relying on an existing ingress from
0.0.0.0/0 have access to ports 20 and /or 21 through another security group. 

Default Value:

VPC automatically comes with a default security group. If you don’t specify a different security group when you launch the instance, the default security group will be associated with the instance. By default, the security group allows all inbound connections.

Pre-Requisite:

1. Before starting the below implementation steps write all configurations which IP and which port in the inbound.

2. Avoid the login through the root user.

3. Only authorized persons can access the Security Groups.

4. You cannot delete the default security groups but you can edit and modify them here so you can create security groups and create your own rules in them.

5. Do not attach the default security group to any EC2 instance if you do not modify any default rules in inbound or outbound.

Remediation:

Test Plan:

• Sign in to AWS Management Console.

• Navigate to AWS VPC dashboard at https://console.aws.amazon.com/vpc

• In the left navigation panel, under the SECURITY section, choose Security Groups.

• Select the Security group that you want to examine.

• Select the Inbound Rules tab from the dashboard bottom panel.

• Verify the value in the Source column for any inbound rules with the Port Range set to 20 or 21 have the source set to 0.0.0.0/0 or::/0 (Anywhere), then the selected security group allows unrestricted data traffic on port 20 or 21.Using AWS CLI:

aws ec2 describe-security-groups 
--filters Name=ip-permission.from-port,Values=20,21 Name=ip-permission.to-port,Values=20,21 Name=ip-permission.cidr,Values='0.0.0.0/0'
--query "SecurityGroups[*].[GroupName]"
--output text

Implementation:

• Sign in to the AWS Management Console.

• Navigate to AWS VPC dashboard at https://console.aws.amazon.com/vpc/

• In the navigation panel, under the SECURITY section, choose Security Groups.

  • Select the Security Group that you want to reconfigure.

  • Select the Inbound Rules tab from the dashboard bottom panel.

  • In the Edit inbound rules dialog box, go-to source column and perform one of the following actions to restrict the inbound traffic: Click on source dropdown

    1. Select My IP to allow inbound traffic only from your machine (i.e, from your IP address only).

• Select Custom and enter IP addresses or names or IDs of another security group based on your access requirements. 

Using AWS CLI:

aws ec2 revoke-security-group-ingress 
--region us-east-1 (select your region)
--group-name tel-sg (your security group name)
--protocol tcp
--port 20 
--cidr 0.0.0.0/0