Open menu
-->

Unrestricted SSH Access

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features
Last updated: 13 April 2018
Security

Risk level: Medium (should be achieved)

Check your EC2 security groups for inbound rules that allow unrestricted access (i.e. 0.0.0.0/0 or ::/0) to TCP port 22. Restrict access to only those IP addresses that require it, in order to implement the principle of least privilege and reduce the possibility of a breach. TCP port 22 is used for secure remote login by connecting an SSH client application with an SSH server: https://en.wikipedia.org/wiki/Secure_Shell

This rule resolution is part of the Cloud Conformity Base Auditing Package

Allowing unrestricted SSH access can increase opportunities for malicious activity such as hacking, man-in-the-middle attacks (MITM) and brute-force attacks.

Audit

To determine if your EC2 security groups allow unrestricted SSH access, perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the left navigation panel, under NETWORK & SECURITY section, choose Security Groups.

04 Click inside the search filed under and select the following options from the dropdown list:

  1. Choose Protocol and select TCP from the protocols list.
  2. Choose Port Range then select SSH as filter input.

05 Select one of the EC2 security groups displayed.

06 Select the Inbound tab located at the bottom of the screen.

07 Verify the value available in the Source column for any inbound/ingress rules with the Port Range set to 22. If one or more rules have the source set to 0.0.0.0/0 or ::/0 (Anywhere), the selected security group allows unrestricted traffic on port 22, therefore the SSH access to the associated EC2 instance(s) is not secured.

08 Repeat steps 5 - 7 to verify the rest of your EC2 security groups returned as a result step 4 above.

09 Change the AWS region from the navigation bar and repeat the audit process for other regions.

Using AWS CLI

01 Run describe-security-groups command (OSX/Linux/UNIX) using the necessary filters to expose the security groups that have ingress rules that allow SSH traffic (TCP port 22) from all addresses (0.0.0.0/0 or ::/0):

aws ec2 describe-security-groups
	--region us-east-1
	--filters Name=ip-permission.from-port,Values=22 Name=ip-permission.to-port,Values=22 Name=ip-permission.cidr,Values='0.0.0.0/0'
	--query 'SecurityGroups[*].{Name:GroupName}'
aws ec2 describe-security-groups
	--region us-east-1
	--filters Name=ip-permission.from-port,Values=22 Name=ip-permission.to-port,Values=22 Name=ip-permission.ipv6-cidr,Values='::/0'
	--query 'SecurityGroups[*].{Name:GroupName}'

02 The command output should return an array with the requested information. If the command does not return any output, there are no EC2 security groups that allow unrestricted SSH access, otherwise it should return the name of the security group(s) that match filter criteria, as shown in the following example:

[
    {
        "Name": "MyWebEC2SecurityGroup"
    },
    {
        "Name": "BastionServerSecurityGroup"
    }
]

03 Repeat step no. 1 and 2 to perform the audit process for other AWS regions.

Remediation / Resolution

To update your security groups inbound/ingress configuration in order to restrict SSH access to specific entities (IP addresses, IP ranges, etc), perform the following:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the navigation panel, under NETWORK & SECURITY section, choose Security Groups.

04 Select the appropriate security group (refer to the Audit section to identify the appropriate security group(s)).

05 Select the Inbound tab and click the Edit button.

06 In the Edit inbound rules dialog box, change the traffic Source for any inbound rules that allow unrestricted access through TCP port 22 by performing one of the following actions:

  1. Select My IP from the Source dropdown list to allow inbound traffic only from your machine (from your IP address).
  2. Select Custom from the Source dropdown list and enter one of the following options based on your access requirements:
    • The static IP/Elastic IP address of the permitted host with the suffix set to /32, e.g. 54.164.53.201/32.
    • The IP address range of the permitted hosts in CIDR notation, for example 54.164.53.201/24.
    • The name or ID of another security group available in the same AWS region.

07 Click Save to apply the changes.

08 Repeat steps no. 4 – 7 to update other EC2 security groups that allow unrestricted SSH access.

09 Change the AWS region from the navigation bar and repeat the process for other regions.

Using AWS CLI

01 First, run revoke-security-group-ingress command (OSX/Linux/UNIX) to remove the inbound rule(s) that allow unrestricted access through TCP port 22, from the selected EC2 security group (the command does not return an output):

aws ec2 revoke-security-group-ingress
	--region us-east-1
	--group-name MyWebEC2SecurityGroup
	--protocol tcp
	--port 22
	--cidr 0.0.0.0/0

02 Run authorize-security-group-ingress command (OSX/Linux/UNIX) to add the inbound rules removed at the previous step with a different set of parameters in order to restrict SSH access to specific entities. To add custom inbound/ingress rules to the selected security group, use one of the following options (the command does not produce an output):

  1. Add an inbound rule that allows SSH access to the specific static IP/Elastic IP address of the permitted host via port 22:
    aws ec2 authorize-security-group-ingress
    	--region us-east-1
    	--group-name MyWebEC2SecurityGroup
    	--protocol tcp
    	--port 22
    	--cidr 54.164.53.201/32
    
  2. Add an inbound rule that allows SSH access to the IP address range of the permitted hosts via port 22:
    aws ec2 authorize-security-group-ingress
    	--region us-east-1
    	--group-name MyWebEC2SecurityGroup
    	--protocol tcp
    	--port 22
    	--cidr 54.164.53.201/24
    
  3. Add an inbound rule that allows SSH access to another EC2 security group in the same AWS region via port 22:
    aws ec2 authorize-security-group-ingress
    	--region us-east-1
    	--group-name MyWebEC2SecurityGroup
    	--protocol tcp
    	--port 22
    	--source-group MyWebAppSecurityGroup
    

03 Repeat step no. 1 and 2 to update other EC2 security groups that allow unrestricted SSH access using AWS CLI.

04 Repeat steps no. 1 - 3 to implement the entire process for other AWS regions.

References

Publication date Jun 19, 2016