# Ensure security list restricts ingress from 0.0.0.0/0 to port 22 (SSH)

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698518635841-ensure-security-list-restricts-ingress-from-00000-to-port-22-ssh
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure no security list rule allows inbound traffic from 0.0.0.0/0 (any IPv4 address on the internet) to TCP port 22, which is used for SSH remote login to Linux instances. Remote administration should come only from trusted IP ranges or through the OCI Bastion service.

**Rationale**

Port 22 open to the whole internet is constantly scanned by attackers, who try password guessing and known exploits against SSH. A single weak password or unpatched service can then give an attacker control of the instance. Limiting SSH to trusted networks, or using OCI Bastion instead, removes this exposure while still allowing administrators to connect.

**Impact**

-   Blocks SSH access from the public internet
    
-   Reduces brute-force and exploit attempts
    
-   Administrators must connect from trusted IP ranges or through OCI Bastion
    

**Default Value**

By default, the default security list of a new VCN includes an ingress rule that allows TCP port 22 from 0.0.0.0/0.

**Pre-Requisites**

-   Permission to manage virtual-network-family in the compartment
    
-   A list of trusted IP ranges that need SSH access, or an OCI Bastion set up
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.
    
3.  Open the Security tab (or Security Lists under Resources on some consoles) and select the security list.
    
4.  Review the ingress rules and look for any rule with source 0.0.0.0/0 that allows TCP port 22, or all protocols or all ports.
    
5.  Repeat for every security list in each VCN.
    
6.  If any such rule is found, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.
    
3.  Open the Security tab (or Security Lists under Resources on some consoles) and select the security list.
    
4.  Find the ingress rule that allows 0.0.0.0/0 to port 22.
    
5.  Select Edit on the rule and change the source CIDR to a trusted IP range, or delete the rule.
    
6.  Save the changes.
    
7.  Confirm that administrators can still connect from trusted networks or through OCI Bastion.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.
    
3.  Open the Security tab (or Security Lists under Resources on some consoles) and select the security list.
    
4.  Add back the previous ingress rule (source 0.0.0.0/0, TCP destination port 22) and save.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/Bastion/Concepts/bastionoverview.htm](https://docs.oracle.com/en-us/iaas/Content/Bastion/Concepts/bastionoverview.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.