Control: 2.4 Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389
Description
Network security groups provide stateful filtering of ingress/egress network traffic to OCI resources. It is recommended that no security group allows unrestricted ingress access to port 3389.
Remediation
From Command Line
Using the details returned from the audit procedure either:
- Remove the security rules
oci network nsg rules remove --nsg-id=<NSGID from audit output>
or
- Update the security rules
oci network nsg rules update --nsg-id=<NSGID from audit output> --security- rules=<updated security-rules JSON (without the isValid or TimeCreated fields)>eg:oci network nsg rules update --nsg- id=ocid1.networksecuritygroup.oc1.iad.xxxxxxxxxxxxxxxxxxxxxx --security- rules='[{ "description": null, "destination": null, "destination-type": null, "direction": "INGRESS", "icmp-options": null, "id": "709001", "is-stateless": null, "protocol": "6", "source": "140.238.154.0/24", "source-type": "CIDR_BLOCK", "tcp-options": { "destination-port-range": { "max": 3389, "min": 3389 }, "source-port-range": null }, "udp-options": null }]'
Usage
Run the control in your terminal:
powerpipe control run oci_compliance.control.cis_v120_2_4Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run oci_compliance.control.cis_v120_2_4 --shareSQL
This control uses a named query:
with non_compliant_rules as ( select id, count(*) as num_noncompliant_rules from oci_core_network_security_group, jsonb_array_elements(rules) as r where r ->> 'direction' = 'INGRESS' and r ->> 'sourceType' = 'CIDR_BLOCK' and r ->> 'source' = '0.0.0.0/0' and ( r ->> 'protocol' = 'all' or ( (r -> 'tcpOptions' -> 'destinationPortRange' ->> 'min')::integer <= 3389 and (r -> 'tcpOptions' -> 'destinationPortRange' ->> 'max')::integer >= 3389 ) ) group by id)select nsg.id as resource, case when non_compliant_rules.id is null then 'ok' else 'alarm' end as status, case when non_compliant_rules.id is null then nsg.display_name || ' ingress restricted for port 3389 from 0.0.0.0/0.' else nsg.display_name || ' contains ' || non_compliant_rules.num_noncompliant_rules || ' ingress rule(s) allowing port 3389 from 0.0.0.0/0.' end as reason , nsg.region as region, nsg.tenant_name as tenant , coalesce(c.name, 'root') as compartmentfrom oci_core_network_security_group as nsg left join non_compliant_rules on non_compliant_rules.id = nsg.id left join oci_identity_compartment c on c.id = nsg.compartment_id;