Description

Ensure no network security group rule allows inbound traffic from 0.0.0.0/0 (any IPv4 address on the internet) to TCP port 22, which is used for SSH remote login to Linux instances. Remote administration should come only from trusted IP ranges or through the OCI Bastion service.

Rationale

Port 22 open to the whole internet is constantly scanned by attackers, who try password guessing and known exploits against SSH. A single weak password or unpatched service can then give an attacker control of the instance. Limiting SSH to trusted networks, or using OCI Bastion instead, removes this exposure while still allowing administrators to connect.

Impact

  • Blocks SSH access from the public internet

  • Reduces brute-force and exploit attempts

  • Administrators must connect from trusted IP ranges or through OCI Bastion

Default Value

By default, a new network security group has no ingress rules.

Pre-Requisites

  • Permission to manage virtual-network-family in the compartment

  • A list of trusted IP ranges that need SSH access, or an OCI Bastion set up

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the Security tab (or Network Security Groups under Resources on some consoles) and select the network security group.

  4. Review the ingress rules and look for any rule with source 0.0.0.0/0 that allows TCP port 22, or all protocols or all ports.

  5. Repeat for every network security group in each VCN.

  6. If any such rule is found, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the Security tab (or Network Security Groups under Resources on some consoles) and select the network security group.

  4. Find the ingress rule that allows 0.0.0.0/0 to port 22.

  5. Select Edit on the rule and change the source CIDR to a trusted IP range, or delete the rule.

  6. Save the changes.

  7. Confirm that administrators can still connect from trusted networks or through OCI Bastion.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and select Virtual cloud networks. Choose the compartment and select the VCN.

  3. Open the Security tab (or Network Security Groups under Resources on some consoles) and select the network security group.

  4. Add back the previous ingress rule (source 0.0.0.0/0, TCP destination port 22) and save.

Reference