Unrestricted Netbios Access Should Not Be Allowed
More Info:
No AWS EC2 security group should allow unrestricted inbound access to TCP port 139 and UDP ports 137 and 138 (NetBIOS).Risk Level
HighAddress
SecurityCompliance Standards
HIPAA, NIST, SOC2, GDPRTriage and Remediation
Remediation
Using Console
Using Console
To remediate the “Unrestricted Netbios Access Should Not Be Allowed” misconfiguration in AWS using the AWS console, you can follow these steps:
- Log in to your AWS Management Console.
- Go to the Amazon VPC dashboard.
- Click on “Security Groups” from the left-hand menu.
- Select the security group that has unrestricted NetBIOS access.
- Click on the “Inbound Rules” tab.
- Locate the rule that allows unrestricted NetBIOS access (usually port 137-139).
- Click on the “Edit” button next to the rule.
- Change the source IP address to a specific IP address or range of IP addresses that should be allowed to access NetBIOS.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the unrestricted NetBIOS access issue in AWS using AWS CLI, follow these steps:
-
Open the AWS CLI and run the following command to list all the security groups in your AWS account:
- Identify the security group that has unrestricted NetBIOS access.
-
Run the following command to revoke the inbound rule that allows unrestricted NetBIOS access:
Note: Replace
<security-group-id>with the ID of the security group that you identified in step 2. -
Run the following command to revoke the inbound rule that allows unrestricted NetBIOS access:
Note: Replace
<security-group-id>with the ID of the security group that you identified in step 2. -
Verify that the inbound rules have been revoked by running the following command:
Note: Replace
<security-group-id>with the ID of the security group that you identified in step 2. - Repeat steps 3-5 for all the security groups in your AWS account that have unrestricted NetBIOS access.
- Once you have revoked the inbound rules for all the security groups, the unrestricted NetBIOS access issue will be remediated.
Using Python
Using Python
To remediate the “Unrestricted Netbios Access Should Not Be Allowed” misconfiguration for AWS using python, you can follow these steps:
- Import the necessary AWS SDK and modules in your python script.
- Create an AWS client for EC2 service.
- Get a list of all the security groups in your AWS account.
- Loop through each security group and check if it has unrestricted NetBIOS access. To do this, check if any of the inbound rules of the security group has the protocol set to “UDP” or “TCP”, the port range set to “137-139”, and the source IP range set to “0.0.0.0/0” or ”::/0”.
- If you find any security group that has unrestricted NetBIOS access, remove the offending inbound rule from the security group using the revoke_security_group_ingress() method of the AWS EC2 client. You will need to provide the security group ID, the protocol, the port range, and the source IP range of the offending rule as parameters to this method.
- After removing the offending rule, you can verify that the security group no longer allows unrestricted NetBIOS access by repeating step 4.