Description

Ensure no security list rule allows inbound traffic from 0.0.0.0/0 (any IPv4 address on the internet) to TCP port 22, which is used for SSH remote login to Linux instances. Remote administration should come only from trusted IP ranges or through the OCI Bastion service.

Rationale

Port 22 open to the whole internet is constantly scanned by attackers, who try password guessing and known exploits against SSH. A single weak password or unpatched service can then give an attacker control of the instance. Limiting SSH to trusted networks, or using OCI Bastion instead, removes this exposure while still allowing administrators to connect.

Impact

  • Blocks SSH access from the public internet

  • Reduces brute-force and exploit attempts

  • Administrators must connect from trusted IP ranges or through OCI Bastion

Default Value

By default, the default security list of a new VCN includes an ingress rule that allows TCP port 22 from 0.0.0.0/0.

Pre-Requisites

  • Permission to manage virtual-network-family in the compartment

  • A list of trusted IP ranges that need SSH access, or an OCI Bastion set up

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the Security tab (or Security Lists under Resources on some consoles) and select the security list.

  4. Review the ingress rules and look for any rule with source 0.0.0.0/0 that allows TCP port 22, or all protocols or all ports.

  5. Repeat for every security list in each VCN.

  6. If any such rule is found, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the Security tab (or Security Lists under Resources on some consoles) and select the security list.

  4. Find the ingress rule that allows 0.0.0.0/0 to port 22.

  5. Select Edit on the rule and change the source CIDR to a trusted IP range, or delete the rule.

  6. Save the changes.

  7. Confirm that administrators can still connect from trusted networks or through OCI Bastion.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the Security tab (or Security Lists under Resources on some consoles) and select the security list.

  4. Add back the previous ingress rule (source 0.0.0.0/0, TCP destination port 22) and save.

Reference