Description:
This check verifies that no Utho Cloud Security Group permits unrestricted inbound access to the PostgreSQL service (TCP port 5432) from any IPv4 (0.0.0.0/0) or IPv6 (::/0) address. PostgreSQL database servers should only be accessible from trusted application servers, private networks, VPN gateways, or authorized administrator IP addresses. Restricting PostgreSQL access minimizes the risk of unauthorized database access, data breaches, and service compromise.
Rationale:
Exposing PostgreSQL directly to the Internet significantly increases the risk of unauthorized access, brute-force attacks, credential theft, and exploitation of database vulnerabilities. PostgreSQL servers should only accept connections from trusted systems that require database access.
This check helps:
Prevent unauthorized access to PostgreSQL databases.
Reduce the risk of data theft, modification, or deletion.
Restrict database connectivity to trusted application servers and internal networks.
Meet security best practices recommended by industry compliance standards.
Impact:
Reduces the attack surface of PostgreSQL database servers.
Prevents Internet-based scanning and attacks targeting PostgreSQL services.
Improves the overall security posture of cloud-hosted databases.
Clients connecting from unauthorized networks will be unable to access the database until their IP addresses are explicitly allowed.
Default Value:
Utho Cloud Security Groups do not automatically restrict PostgreSQL access. If administrators create an inbound rule allowing TCP port 5432 from 0.0.0.0/0 or ::/0, the Security Group is considered non-compliant.
Pre-requisites:
Utho Cloud account.
Permissions to view and manage Security Groups.
Access to the Utho Cloud Console or Utho API.
PostgreSQL servers or compute instances protected by Security Groups.
Default Value:
Utho Cloud Security Groups do not automatically restrict POstgres SQL access. If administrators create an inbound rule allowing TCP port 3306 from 0.0.0.0/0 or ::/0, the Security Group is considered non-compliant.
Pre-requisites
Utho Cloud account.
Permissions to view and manage Security Groups.
Access to the Utho Cloud Console or Utho API.
Postgres SQL servers or compute instances protected by Security Groups.
Remediation Steps:
Test Plan:
Using the Utho Cloud Console
Sign in to the Utho Cloud Console.
Navigate to Networking → Security Groups.
Select each Security Group.
Review all inbound (Ingress) rules.
Verify that no rule exists with:
Protocol = TCP
Port = 5432
Source = 0.0.0.0/0 (or ALL)
OR
Source = ::/0 (or ALL)
If an unrestricted Redis rule exists, the Security Group is non-compliant.
Using the Utho API
List all Security Groups (Firewalls).
curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/firewall
Retrieve the details of each Security Group.
curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/firewall/<FIREWALL_ID>
Implementation Plan:
Using the Utho Cloud Console
Log in to the Utho Cloud Console.
Navigate to Networking → Security Groups.
Select the non-compliant Security Group and click Manage.
Locate the inbound rule allowing:
Protocol: TCP
Port: 5432
Source: 0.0.0.0/0 or ::/0
Delete the unrestricted Redis rule.
Create a new inbound rule allowing access only from:
Application server Security Groups.
Private VPC/Subnet CIDR ranges.
VPN gateway IP ranges.
Specific trusted administrator or management IP addresses (if administrative access is required).
Save the Security Group.
Verify Redis connectivity from authorized clients only.
Using the Utho API
Delete the unrestricted Redis rule using the Rule ID obtained from the firewall details.
curl -s -X DELETE \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/firewall/<FIREWALL_ID>/rule/<RULE_ID>/delete
Create a restricted Redis rule.
curl -s -X POST \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"type":"incoming",
"protocol":"TCP",
"port":"5432",
"addresses":"10.0.0.0/16"
}' \
https://api.utho.com/v2/firewall/<FIREWALL_ID>/rule/add
Replace 10.0.0.0/16 with your organization's trusted private network or approved CIDR range.
Backout Plan:
Log in to the Utho Cloud Console.
Navigate to Networking → Security Groups.
Select the modified Security Group.
Restore the previous Postgres SQL rule if legitimate application connectivity is interrupted.
Verify Postgres SQL connectivity.
Replace the temporary rule with one that restricts access to trusted private networks or approved IP ranges, rather than allowing unrestricted Internet access.
References: