Description

Ensure each Public Cloud Database service allows connections only from specific, trusted IP addresses or CIDR ranges, such as application servers or VPNs, and that no authorized entry allows the whole internet (0.0.0.0/0).

Rationale

A database reachable from any IP address is exposed to password attacks and exploitation of any vulnerability. Allowing only known sources adds a network barrier in front of the database, so even a leaked password cannot be used from unknown networks.

Impact

  • Only trusted sources can connect

  • Reduces exposure to attacks from the internet

  • New application servers must be added to the list

Default Value

By default, no IP is authorized, so nobody can connect to the service until at least one IP is added. OVHcloud notes that 0.0.0.0/0 should only be used for troubleshooting.

Pre-Requisites

  • Permission to manage the database service

  • A list of IP addresses or ranges that need access

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.

  4. Open the Configuration tab and review the authorized IP addresses.

  5. If any entry allows 0.0.0.0/0 or overly broad ranges, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.

  4. Open the Configuration tab, enter each specific IP address or CIDR block with a description, and click the + button.

  5. Delete any entry that allows 0.0.0.0/0 or ranges that are no longer needed, using the ⋯ button in the IP table.

  6. Confirm that applications can still connect.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.

  4. Open the Configuration tab and add back the removed entries.

Reference