AWS Introduction
AWS Pricing
AWS Threats
AWS Misconfigurations
- Getting Started with AWS Audit
- Permissions required for Misconfigurations Detection
- API Gateway Audit
- Cloudformation Audit
- CloudFront Audit
- CloudTrail Audit
- Cloudwatch Audit
- DynamoDB Audit
- EC2 Audit
- Elastic Search Audit
- ELB Audit
- IAM Audit
- KMS Audit
- Kubernetes Audit
- Lambda Audit
- RDS Audit
- Redshift Audit
- Route53 Audit
- S3 Audit
- Security Groups Audit
- SES Audit
- SNS Audit
- IAM Deep Dive
- App Sync Audit
- Code Build Audit
- Open Search Audit
- Shield Audit
- SQS Audit
Unrestricted SSH Access Should Not Be Allowed
More Info:
No security group should allow unrestricted inbound access to TCP port 22 (SSH).
Risk Level
Medium
Address
Security
Compliance Standards
HIPAA, PCIDSS, NIST, SOC2, CISAWS, CBP, HITRUST, AWSWAF, GDPR, NISTCSF, FedRAMP
Triage and Remediation
Remediation
To remediate the unrestricted SSH access misconfiguration in AWS using the AWS console, you can follow these steps:
- Log in to the AWS Management Console.
- Navigate to the EC2 service.
- Select the EC2 instance(s) that have unrestricted SSH access.
- Click on the “Actions” button and select “Networking” and then “Change Security Groups”.
- In the “Change Security Groups” window, select the security group associated with the instance(s) and click “Edit”.
- In the “Edit inbound rules” window, locate the SSH rule (port 22) and remove it or restrict it to only allow traffic from specific IP addresses or ranges.
- Click “Save” to apply the changes.
Once you have completed these steps, the unrestricted SSH access misconfiguration will be remediated and the instance(s) will be more secure.
To remediate unrestricted SSH access in AWS using AWS CLI, follow these steps:
-
Open the AWS CLI on your local machine.
-
Run the following command to list all the security groups in your AWS account:
aws ec2 describe-security-groups
-
Identify the security group that allows unrestricted SSH access. You can look for a security group that has a rule allowing SSH traffic from 0.0.0.0/0 (any IP address) or ::/0 (any IPv6 address).
-
Once you have identified the security group, note down its Group ID.
-
Run the following command to revoke the SSH access rule from the security group:
aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 22 --cidr 0.0.0.0/0
Replace <security-group-id> with the Group ID of the security group that allows unrestricted SSH access.
- Verify that the SSH access rule has been revoked by running the following command:
aws ec2 describe-security-groups --group-ids <security-group-id>
Replace <security-group-id> with the Group ID of the security group that allows unrestricted SSH access.
- Repeat the above steps for all the security groups in your AWS account to ensure that SSH access is not allowed from any unauthorized IP addresses.
To remediate the unrestricted SSH access issue in AWS using Python, follow these steps:
- Import the necessary AWS SDKs and libraries in your Python script. You will need to import the
boto3library to interact with AWS services.
import boto3
- Create a client session for EC2 using
boto3.client().
ec2 = boto3.client('ec2')
- Use the
describe_security_groups()method to retrieve all the security groups in your AWS account.
security_groups = ec2.describe_security_groups()
- Loop through each security group and check if it has any inbound rules allowing SSH access from any IP address (
0.0.0.0/0).
for sg in security_groups['SecurityGroups']:
for rule in sg['IpPermissions']:
if rule['IpProtocol'] == 'tcp' and rule['FromPort'] <= 22 and rule['ToPort'] >= 22:
for ip_range in rule['IpRanges']:
if ip_range['CidrIp'] == '0.0.0.0/0':
print(f"Security group {sg['GroupId']} allows unrestricted SSH access.")
- If any security group is found to have unrestricted SSH access, use the
revoke_security_group_ingress()method to remove the rule allowing SSH access from any IP address.
ec2.revoke_security_group_ingress(
GroupId=sg['GroupId'],
IpPermissions=[
{
'IpProtocol': 'tcp',
'FromPort': 22,
'ToPort': 22,
'IpRanges': [
{
'CidrIp': '0.0.0.0/0'
}
]
}
]
)
- Run the Python script to remediate the unrestricted SSH access issue in your AWS account.
Note: Make sure to run the script with appropriate AWS credentials and permissions.