Rule: Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389
This rule ensures that Network ACLs do not permit traffic from 0.0.0.0/0 to specific ports.
| Rule | Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389 |
| Framework | AWS Foundational Security Best Practices |
| Severity | ✔ Medium |
Rule Description
This rule ensures that the Network Access Control Lists (ACLs) in an AWS environment do not permit incoming traffic from any source IP address (0.0.0.0/0) to port 22 (SSH) or port 3389 (RDP). This is a best practice recommended by AWS for enhanced security and mitigating the risk of unauthorized access to sensitive resources.
Troubleshooting Steps
If your Network ACLs allow inbound traffic from 0.0.0.0/0 to port 22 or port 3389, it can pose a potential security risk as it allows unrestricted access to SSH and RDP services. Troubleshooting steps to address this issue are as follows:
- 1.
Identify affected Network ACL:
- Log in to the AWS Management Console.
- Go to the Amazon VPC service.
- 2.
Identify associated subnets:
- From the VPC Dashboard, navigate to "Subnets".
- Identify all the subnets associated with the affected Network ACL.
- 3.
Review Network ACL rules:
- Go to the "Network ACLs" section of the VPC Dashboard.
- Locate the Network ACL identified in step 1.
- Review the inbound rules for the Network ACL.
- Check whether any rules allow ingress from 0.0.0.0/0 to port 22 or port 3389.
- 4.
Update Network ACL rules:
- Select the Network ACL that needs modification.
- Remove any inbound rules that allow ingress from 0.0.0.0/0 to port 22 or port 3389.
- Save the changes.
Necessary Codes (if applicable)
In order to modify the Network ACL rules, you need to use AWS Command Line Interface (CLI) or AWS SDKs. Here is an example of how you can update the Network ACL rules using AWS CLI:
$ aws ec2 replace-network-acl-entry --network-acl-id <network-acl-id> --ingress --rule-number <rule-number> --protocol <protocol> --port-range FromPort=<from-port>,ToPort=<to-port> --source-cidr-block 0.0.0.0/0 --rule-action deny
Please replace the placeholders with the actual values:
: ID of the Network ACL you want to modify.<network-acl-id>
: The rule number of the specific ingress rule to be updated. This can be obtained from the AWS Management Console.<rule-number>
: The protocol you want to restrict (e.g., tcp).<protocol>
: The starting port number for the rule.<from-port>
: The ending port number for the rule.<to-port>
Execute the above command for each rule that allows ingress from 0.0.0.0/0 to either port 22 or port 3389.
Remediation Steps
Follow the steps below to remediate the issue and meet the AWS best practice:
- 1.
Log in to the AWS Management Console.
- 2.
Go to the Amazon VPC service.
- 3.
Identify the Network ACL that needs modification.
- 4.
Review the inbound rules for the Network ACL.
- 5.
Remove any rules that permit ingress from 0.0.0.0/0 to port 22 or port 3389.
- 6.
Save the changes.
- 7.
Verify the Network ACL changes by testing connectivity to port 22 and port 3389 from outside the allowed IP ranges.
- 8.
If necessary, update the rules to allow access to these ports from specific trusted IP ranges.
- 9.
Regularly review and update Network ACLs to ensure ongoing security compliance.
Note: It is essential to consider the impact of modifying Network ACL rules on your environment and ensure that valid and secure access is maintained while restricting unauthorized access.