Profile Applicability:

Level 1

Description:

Enabling Block Project-Wide SSH Keys for VM instances ensures that only instance-specific SSH keys are used for access, preventing the use of shared project-wide SSH keys.

Rationale:

Project-wide SSH keys, stored in Compute Engine project metadata, provide access to all instances in a project. This approach simplifies SSH key management but increases security risks. If project-wide SSH keys are compromised, all instances within the project are vulnerable. By using instance-specific SSH keys, access is limited to individual instances, reducing the potential attack surface.

Impact:

  • Users relying on project-wide SSH keys will lose access to affected instances.

  • Users accessing instances via the gcloud command-line tool or GCP Console SSH feature will not need manual key distribution.

  • For users using third-party SSH clients, instance-specific SSH keys must be manually created and distributed.

Default Value:

By default, Block Project-Wide SSH Keys is not enabled for VM instances.

Audit Steps:

From Google Cloud Console:

  1. Navigate to the VM Instances page: https://console.cloud.google.com/compute/instances.

                         

  1. Click the name of each instance to view its details.

                   

  1. Under SSH Keys, verify that Block project-wide SSH keys is selected.

                   

From Google Cloud CLI:

List all instances and check their metadata:

gcloud compute instances list --format=json
  1. Ensure the metadata key block-project-ssh-keys is set to true for all instances.

Remediation Steps:

From Google Cloud Console:

  1. Navigate to the VM Instances page: https://console.cloud.google.com/compute/instances.

                                 

  1. Click the name of the affected instance.

                 

  1. Click Edit in the toolbar.

               

  1. Under SSH Keys, select the checkbox Block project-wide SSH keys.

                   

  1. Click Save at the bottom of the page.

                   

  1. Repeat these steps for all impacted instances.

From Google Cloud CLI:

Set the block-project-ssh-keys metadata value to true:

gcloud compute instances add-metadata <INSTANCE_NAME> --metadata block-project-ssh-keys=TRUE

References:

  1. Adding and Removing SSH Keys

  2. gcloud Formats

Additional Information:

  • If OS Login is enabled, SSH keys in instance metadata are ignored, and blocking project-wide SSH keys is unnecessary.

CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.10 Encrypt Sensitive Data in Transit

Encrypt sensitive data in transit using protocols like TLS and SSH.


5.2 Use Unique Passwords

Use unique passwords for enterprise assets to reduce unauthorized access risks.

16.5 Encrypt Credential Transmittals

Ensure all usernames and authentication credentials are transmitted using encrypted channels.