Open smbotcp remediation

Using Console

Using CLI

To remediate the misconfiguration “Windows SMB Port Should Not Be Open” for GCP using GCP CLI, you can follow these steps:

Login to your GCP console using your credentials.
Open the Cloud Shell by clicking on the icon located on the top right corner of the console.
Run the following command to list all the instances in your project:

gcloud compute instances list

Identify the instance which has the open SMB port.
Run the following command to SSH into the instance:

gcloud compute ssh [INSTANCE_NAME]

Once you are logged in to the instance, run the following command to check if the SMB port is open:

sudo netstat -tuln | grep 445

If the SMB port is open, run the following command to stop the SMB service:

sudo systemctl stop smbd

Run the following command to disable the SMB service from starting on boot:

sudo systemctl disable smbd

Finally, run the following command to confirm that the SMB port is no longer open:

sudo netstat -tuln | grep 445

Exit the SSH session by running the following command:

exit

By following these steps, you will have successfully remediated the misconfiguration “Windows SMB Port Should Not Be Open” for GCP using GCP CLI.

Using Python

To remediate the misconfiguration “Windows SMB Port Should Not Be Open” on GCP using Python, you can follow the below steps:

Use the Google Cloud SDK to authenticate and authorize access to your GCP account.
Use the Python google-cloud-compute library to create a new firewall rule that blocks the Windows SMB port (TCP port 445) on all instances in your GCP project.
Here is the sample Python code to create a new firewall rule:

from google.cloud import compute_v1

# Create a compute client
compute_client = compute_v1.InstancesClient()

# Get the project ID and zone
project_id = 'your-project-id'
zone = 'us-central1-a'

# Define the firewall rule
firewall_rule = {
    "name": "block-smb",
    "direction": "INGRESS",
    "priority": 1000,
    "targetTags": ["windows"],
    "allowed": [],
    "denied": [
        {
            "IPProtocol": "tcp",
            "ports": ["445"]
        }
    ],
    "sourceRanges": ["0.0.0.0/0"],
}

# Create the firewall rule
operation = compute_client.insert_firewall(project=project_id, firewall_resource=firewall_rule)
result = operation.result()

In the above code, replace your-project-id with your GCP project ID and us-central1-a with your preferred zone.
The above code creates a new firewall rule named “block-smb” that blocks TCP port 445 on all instances with the tag “windows”. You can add this tag to your Windows instances to apply the firewall rule.
After running the above code, you should see a new firewall rule named “block-smb” in your GCP console.
Verify that the firewall rule is working as expected by testing the Windows SMB port from outside your GCP network.

By following the above steps, you can remediate the misconfiguration “Windows SMB Port Should Not Be Open” on GCP using Python.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Open smbotcp remediation

Triage and Remediation

Remediation

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

​Triage and Remediation

​Remediation

Triage and Remediation

Remediation