Unrestricted SSH Access Should Not Be Allowed
More Info:
No security group should allow unrestricted inbound access to TCP port 22 (SSH).Risk Level
MediumAddress
SecurityCompliance Standards
HIPAA, PCIDSS, NIST, SOC2, CISAWS, CBP, HITRUST, AWSWAF, GDPR, NISTCSF, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the unrestricted SSH access misconfiguration in AWS using the AWS console, you can follow these steps:
- Log in to the AWS Management Console.
- Navigate to the EC2 service.
- Select the EC2 instance(s) that have unrestricted SSH access.
- Click on the “Actions” button and select “Networking” and then “Change Security Groups”.
- In the “Change Security Groups” window, select the security group associated with the instance(s) and click “Edit”.
- In the “Edit inbound rules” window, locate the SSH rule (port 22) and remove it or restrict it to only allow traffic from specific IP addresses or ranges.
- Click “Save” to apply the changes.
Using CLI
Using CLI
To remediate unrestricted SSH access in AWS using AWS CLI, follow these steps:Replace Replace
- Open the AWS CLI on your local machine.
- Run the following command to list all the security groups in your AWS account:
- Identify the security group that allows unrestricted SSH access. You can look for a security group that has a rule allowing SSH traffic from 0.0.0.0/0 (any IP address) or ::/0 (any IPv6 address).
- Once you have identified the security group, note down its Group ID.
- Run the following command to revoke the SSH access rule from the security group:
<security-group-id> with the Group ID of the security group that allows unrestricted SSH access.- Verify that the SSH access rule has been revoked by running the following command:
<security-group-id> with the Group ID of the security group that allows unrestricted SSH access.- Repeat the above steps for all the security groups in your AWS account to ensure that SSH access is not allowed from any unauthorized IP addresses.
Using Python
Using Python
To remediate the unrestricted SSH access issue in AWS using Python, follow these steps:
- Import the necessary AWS SDKs and libraries in your Python script. You will need to import the
boto3library to interact with AWS services.
- Create a client session for EC2 using
boto3.client().
- Use the
describe_security_groups()method to retrieve all the security groups in your AWS account.
- Loop through each security group and check if it has any inbound rules allowing SSH access from any IP address (
0.0.0.0/0).
- If any security group is found to have unrestricted SSH access, use the
revoke_security_group_ingress()method to remove the rule allowing SSH access from any IP address.
- Run the Python script to remediate the unrestricted SSH access issue in your AWS account.