Description:
Security Groups control incoming and outgoing network traffic for Utho cloud instances. Oracle Database commonly uses TCP port 1521 for database connections and TCP port 2483 for Oracle Net Services. These ports should not be accessible from unrestricted sources such as the public internet.
Access to ports 1521 and 2483 should be restricted to trusted IP addresses or private network ranges that require access to the Oracle Database.
Rationale:
Allowing unrestricted access to Oracle Database ports can expose database services to unauthorized users and increase the risk of attacks. Restricting access to trusted sources reduces unnecessary network exposure and helps protect database services.
Impact:
Systems outside the allowed source IP addresses or network ranges will not be able to connect to the Oracle Database.
Applications that require database access must be included in the allowed source ranges.
Database connectivity should be verified after changing the Security Group rules.
Default Value:
Utho allows administrators to configure Security Group rules. Unrestricted access to Oracle Database ports is not automatically prevented and must be reviewed and restricted as required.
Pre-requisites:
A Utho account with permission to manage Security Groups.
Access to the Utho Console.
Permission to create and delete Incoming Rules.
Knowledge of the trusted IP addresses or private network ranges that require access to the Oracle Database.
Remediation
Test Plan:
Using the Utho Console
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the Security Group associated with the Oracle Database cloud instance.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Review the configured Service, Protocol, Port, and Source values.
Check for rules allowing TCP access to ports 1521 or 2483.
Verify that the Source is not configured as 0.0.0.0/0 or ::/0.
Confirm that access to ports 1521 and 2483 is restricted to trusted IP addresses or private network ranges.
If any Incoming Rule allows unrestricted access to port 1521 or 2483, follow the Implementation Steps to remediate the issue.
Using the Utho API
Use the Utho API to retrieve the Security Group configuration and review the Incoming Rules.
curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \
https://api.utho.com/v2/security-groups/<security-group-id>
Verify that ports 1521 and 2483 are not allowed from unrestricted sources such as 0.0.0.0/0 or ::/0.
Implementation Steps:
Using the Utho Console
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the Security Group associated with the Oracle Database cloud instance.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Locate any rule that allows TCP traffic on port 1521 or 2483 from an unrestricted source.
Delete the unrestricted Incoming Rule.
Under Add Incoming Rule, configure the required restricted rule:
Service: CUSTOM
Protocol: TCP
Port: 1521 or 2483
Sources: Trusted IP address or private CIDR range
Do not use 0.0.0.0/0 or ::/0 in the Sources field.
Click Add Rule.
Using the Utho API
Use the Utho API to apply the required Security Group configuration.
curl -X PUT \
-H "Authorization: Bearer $UTHO_API_TOKEN" \
-H "Content-Type: application/json" \
-d '<updated-security-group-rule>' \
https://api.utho.com/v2/security-groups/<security-group-id>
Verify that the updated Security Group does not allow unrestricted access to ports 1521 or 2483.
Backout Plan:
Sign in to the Utho Console using an account with appropriate permissions.
Navigate to Network → Security Groups.
Locate the affected Security Group.
Click Manage for the selected Security Group.
Open the Incoming Rules section.
Add the previous Incoming Rule configuration if access needs to be restored.
Enter the required Service, Protocol, Port, and Sources values.
Click Add Rule.
References: