Control: 2.1 Ensure no security lists allow ingress from 0.0.0.0/0 to port 22

Description

Security lists provide stateful or stateless filtering of ingress/egress network traffic to OCI resources on a subnet level. It is recommended that no security group allows unrestricted ingress access to port 22.

Removing unfettered connectivity to remote console services, such as Secure Shell (SSH), reduces a server's exposure to risk.

Remediation

From Console

Follow the audit procedure above.
For each security list in the returned results, click the security list name.
Either edit the ingress rule to be more restrictive, delete the ingress rule or click on the VCN and terminate the security list as appropriate.

From CLI

Follow the audit procedure.
For each of the security lists identified, execute the following command:

oci network security-list get --security-list-id <security list id>

Then either:

Update the security list by copying the ingress-security-rules element from the JSON returned by the above command, edit it appropriately and use it in the following command:

oci network security-list update --security-list-id <security-list-id> -- ingress-security-rules '<ingress security rules JSON>'

Delete the security list

oci network security-list delete --security-list-id <security list id>

Usage

Run the control in your terminal:

powerpipe control run oci_compliance.control.cis_v200_2_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run oci_compliance.control.cis_v200_2_1 --share

SQL

This control uses a named query:

with non_compliant_rules as (
  select
    id,
    count(*) as num_noncompliant_rules
  from
    oci_core_security_list,
    jsonb_array_elements(ingress_security_rules) as p
  where
    p ->> 'source' = '0.0.0.0/0'
    and (
      (
        p ->> 'protocol' = 'all'
        and (p -> 'tcpOptions' -> 'destinationPortRange' -> 'min') is null
      )
      or (
        p ->> 'protocol' = '6' and
        (p -> 'tcpOptions' -> 'destinationPortRange' ->> 'min')::integer <= 22
        and (p -> 'tcpOptions' -> 'destinationPortRange' ->> 'max')::integer >= 22
      )
    )
  group by id
)
select
  osl.id as resource,
  case
    when non_compliant_rules.id is null then 'ok'
    else 'alarm'
  end as status,
  case
    when non_compliant_rules.id is null then osl.display_name || ' ingress restricted for SSH from 0.0.0.0/0.'
    else osl.display_name || ' contains '|| non_compliant_rules.num_noncompliant_rules || ' ingress rule(s) allowing SSH from 0.0.0.0/0.'
  end as reason
  
  , osl.region as region, osl.tenant_name as tenant
  , coalesce(c.name, 'root') as compartment
from
  oci_core_security_list as osl
  left join non_compliant_rules on non_compliant_rules.id = osl.id
  left join oci_identity_compartment c on c.id = osl.compartment_id;