Project: KICS (Provisioning / Security & Compliance)
File: 2ade1579-4b2c-4590-bebb-f99bf597f612.md

title: Network Security Group With Unrestricted Access To SSH hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2ade1579-4b2c-4590-bebb-f99bf597f612 Query name: Network Security Group With Unrestricted Access To SSH Platform: AzureResourceManager Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: Port 22 (SSH) is exposed to the Internet<br> ```json title="Positive test num. 1 - json file" hl_lines="19" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "security group", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2020-11-01", "location": "location1", "tags": {}, "properties": { "securityRules": [ { "id": "id", "properties": { "description": "access to SSH", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "22", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 301, "direction": "Inbound" }, "name": "security rule" }, { "id": "id2", "properties": { "description": "access to RDP", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "3389", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Deny", "priority": 301, "direction": "Inbound" }, "name": "security rule2" } ] }, "resources": [] } ], "outputs": {} } ``` ```json title="Positive test num. 2 - json file" hl_lines="13" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "sample/securitygroup", "type": "Microsoft.Network/networkSecurityGroups/securityRules", "apiVersion": "2020-11-01", "properties": { "description": "access to SSH", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRanges": [ "22-23" ], "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 100, "direction": "Inbound" } } ], "outputs": {} } ``` ```json title="Positive test num. 3 - json file" hl_lines="20" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "securitygroup", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2020-11-01", "location": "location1", "tags": {}, "properties": {}, "resources": [ { "type": "securityRules", "apiVersion": "2020-11-01", "properties": { "description": "access to SSH", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRanges": [ "22-23" ], "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 100, "direction": "Inbound" }, "name": "sr" } ] } ], "outputs": {} } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="21" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "security group", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2020-11-01", "location": "location1", "tags": {}, "properties": { "securityRules": [ { "id": "id", "properties": { "description": "access to SSH", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "22", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 301, "direction": "Inbound" }, "name": "security rule" } ] }, "resources": [] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="15" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "sample/securitygroup", "type": "Microsoft.Network/networkSecurityGroups/securityRules", "apiVersion": "2020-11-01", "properties": { "description": "access to SSH", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRanges": [ "22-23" ], "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 100, "direction": "Inbound" } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="22" { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "securitygroup", "type":

"apiVersion": "2020-11-01", "location": "location1", "tags": {}, "properties": {}, "resources": [ { "type": "securityRules", "apiVersion": "2020-11-01", "properties": { "description": "access to SSH", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRanges": [ "22-23" ], "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 100, "direction": "Inbound" }, "name": "sr" } ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> ```json title="Negative test num. 1 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "security group", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2020-11-01", "location": "location1", "tags": {}, "properties": { "securityRules": [ { "id": "id", "properties": { "description": "access to SSH", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "22", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Deny", "priority": 301, "direction": "Inbound" }, "name": "security rule" } ] }, "resources": [] } ], "outputs": {} } ``` ```json title="Negative test num. 2 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "sample/securitygroup", "type": "Microsoft.Network/networkSecurityGroups/securityRules", "apiVersion": "2020-11-01", "properties": { "description": "access", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRanges": [ "4030-5100" ], "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 100, "direction": "Inbound" } } ], "outputs": {} } ``` ```json title="Negative test num. 3 - json file" { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "securitygroup", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2020-11-01", "location": "location1", "tags": {}, "properties": {}, "resources": [ { "type": "securityRules", "apiVersion": "2020-11-01", "properties": { "description": "access", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRanges": [ "6634" ], "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 100, "direction": "Inbound" }, "name": "sr" } ] } ], "outputs": {} } ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "security group", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2020-11-01", "location": "location1", "tags": {}, "properties": { "securityRules": [ { "id": "id", "properties": { "description": "access to SSH", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRange": "22", "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Deny", "priority": 301, "direction": "Inbound" }, "name": "security rule" } ] }, "resources": [] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> <details><summary>Negative test num. 5 - json file</summary> ```json { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "sample/securitygroup", "type": "Microsoft.Network/networkSecurityGroups/securityRules", "apiVersion": "2020-11-01", "properties": { "description": "access", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRanges": [ "4030-5100" ], "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 100, "direction": "Inbound" } } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details> <details><summary>Negative test num. 6 - json file</summary> ```json { "properties": { "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "2.0.0.0", "apiProfile": "2019-03-01-hybrid", "parameters": {}, "variables": {}, "functions": [], "resources": [ { "name": "securitygroup", "type": "Microsoft.Network/networkSecurityGroups", "apiVersion": "2020-11-01", "location": "location1", "tags": {}, "properties": {}, "resources": [ { "type": "securityRules", "apiVersion": "2020-11-01", "properties": { "description": "access", "protocol": "Tcp", "sourcePortRange": "*", "destinationPortRanges": [ "6634" ], "sourceAddressPrefix": "*", "destinationAddressPrefix": "*", "access": "Allow", "priority": 100, "direction": "Inbound" }, "name": "sr" } ] } ], "outputs": {} }, "parameters": {} }, "kind": "template", "type": "Microsoft.Blueprint/blueprints/artifacts", "name": "myTemplate" } ``` </details>