Description:

This check verifies that no Utho Cloud Security Group permits unrestricted inbound SSH access (TCP port 22) from any IPv4 (0.0.0.0/0) or IPv6 (::/0) address. SSH should only be accessible from trusted IP addresses, corporate networks, VPN gateways, or bastion hosts. Restricting SSH access minimizes the exposure of administrative interfaces to unauthorized users and automated attacks.


Rationale:

Allowing unrestricted SSH access from the Internet significantly increases the risk of unauthorized access and compromise of cloud resources.

This check helps:

  • Prevent brute-force and credential-stuffing attacks against SSH services.

  • Reduce the attack surface of cloud instances.

  • Restrict administrative access to trusted networks.

  • Meet security best practices recommended by industry compliance standards.


Impact:

  • Reduces the likelihood of unauthorized administrative access.

  • Minimizes exposure to Internet-based scanning and brute-force attacks.

  • Improves the overall security posture of cloud workloads.

  • Administrators connecting from unauthorized networks will be unable to access instances until their IP addresses are explicitly allowed.


Default Value:

Utho Cloud Security Groups do not automatically restrict SSH access. If administrators create an inbound rule allowing TCP port 22 from 0.0.0.0/0 or::/0, the Security Group is considered non-compliant.


Pre-requisites:

  • Utho Cloud account.

  • Permissions to view and manage Security Groups.

  • Access to the Utho Cloud Console or Utho API.

  • Compute instances protected by Security Groups.


Test Plan:

  1. Sign in to the Utho Cloud Console.

  2. Navigate to Networking → Security Groups.

  3. Select each Security Group.

  4. Review all inbound (Ingress) rules.

  5. Verify that no rule exists with:

    • Protocol = TCP

    • Port = 22

    • Source = 0.0.0.0/0 (or) ALL

    • OR Source = ::/0 (or) ALL

  1. If an unrestricted SSH rule exists, follow the implementation steps.


Using the Utho API:

List every firewall, then inspect each firewall's rules array for an open incoming TCP/22 rule.

curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" https://api.utho.com/v2/firewall


curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" https://api.utho.com/v2/firewall/<FIREWALL_ID>

Fail if any object in the firewall's rules[] has type=incoming, protocol=TCP, port=22, and addresses=0.0.0.0/0 (or ::/0). Pass if port 22 is absent from incoming rules or every such rule lists a specific trusted CIDR.

Implementation Plan:

  1. Log in to the Utho Cloud Console.

  2. Navigate to Networking → Security Groups.

          

  1. Select the non-compliant Security Group and click on Manage.

  1. Locate the inbound rule allowing:

    • Protocol: TCP

    • Port: 22

    • Source: 0.0.0.0/0 or ::/0

  2. Delete the rule.

  1. Create a new SSH rule allowing access only from:

    • Corporate public IP addresses.

    • VPN gateway IP ranges.

    • Bastion host IP addresses.

    • Specific administrator IP addresses.

  

  1. Save the Security Group.


Using the Utho API:

Delete the open rule (using the rule id from the GET above) and add a source-restricted replacement.

curl -s -X DELETE -H "Authorization: Bearer $UTHO_API_TOKEN" https://api.utho.com/v2/firewall/<FIREWALL_ID>/rule/<RULE_ID>/delete


curl -s -X POST -H "Authorization: Bearer $UTHO_API_TOKEN" -H "Content-Type: application/json" -d '{"type":"incoming","service":"SSH","protocol":"TCP","port":"22","addresses":"203.0.113.10/32"}' https://api.utho.com/v2/firewall/<FIREWALL_ID>/rule/add

Backout Plan:

  1. Log in to the Utho Cloud Console.

  2. Navigate to Networking → Security Groups.

  3. Select the modified Security Group.

  4. Restore the previous SSH rule if legitimate administrative access is interrupted.

  5. Verify SSH connectivity.

  6. Update the rule later with the correct trusted IP ranges instead of allowing unrestricted Internet access.

References: