SQL Server Port Should Not Be Open
More Info:
Determines if TCP port 1433 or UDP port 1434 for SQL Server is open to the public.Risk Level
MediumAddress
SecurityCompliance Standards
SOC2, GDPR, HIPAA, HITRUST, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the SQL Server Port Should Not Be Open misconfiguration in GCP using GCP console, follow these steps:
- Go to the GCP console and select the project where the misconfiguration exists.
- Navigate to the VPC network page and select the VPC network where the SQL Server instance is running.
- Select the Firewall rules tab.
- Identify the firewall rule that allows access to the SQL Server port (default port is 1433).
- Click on the Edit button to modify the firewall rule.
- In the Source filter section, select the IP ranges that are allowed to access the SQL Server port.
- If the SQL Server instance is only accessed from within the VPC network, select the VPC network as the source filter.
- If the SQL Server instance is accessed from outside the VPC network, select the appropriate IP ranges for the source filter.
- Save the changes to the firewall rule.
Using CLI
Using CLI
To remediate an SQL Server port being open in GCP using GCP CLI, follow these steps:
- Open the Google Cloud Console and navigate to the Compute Engine page.
- Identify the instance with the open SQL Server port.
- Connect to the instance using SSH.
-
Run the following command to list the firewall rules:
- Identify the firewall rule that allows the SQL Server port to be open.
-
Run the following command to delete the firewall rule:
Replace
[FIREWALL_RULE_NAME]with the name of the firewall rule that allows the SQL Server port to be open. -
Verify that the firewall rule has been deleted by running the following command:
The output should not include the firewall rule that allowed the SQL Server port to be open.
- Once the firewall rule has been deleted, the SQL Server port will no longer be open. You can verify this by attempting to connect to the SQL Server port from a remote machine.
Using Python
Using Python
To remediate the SQL Server Port Should Not Be Open misconfiguration in GCP using Python, you can follow these steps:In the above code snippet, replace In the above code snippet, replace
- Connect to the Google Cloud Platform using the Google Cloud SDK.
- Use the Google Cloud Python client library to create a firewall rule that blocks all incoming traffic to the SQL Server port. Here’s an example code snippet to create a firewall rule:
your-project-id and your-region with your actual project ID and region. The target_tags field specifies the tags of the resources that should be blocked from accessing the SQL Server port.- Apply the
sql-servertag to all the instances that are running SQL Server.
your-project-id, your-region, and your-instance-name with your actual project ID, region, and instance name. The tags field specifies the tags that should be applied to the instance.- Verify that the firewall rule is working as expected by attempting to connect to the SQL Server port from a remote machine. The connection should be blocked.