OpenStack Security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp) misconfiguration detec

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENSTACK_2
Category - Subcategory	Public Exposure - Sensitive Ports
Provider	OTHER
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

Allowing unrestricted ingress access on port 22 (SSH) in OpenStack security groups exposes instances to potential unauthorized access and brute force attacks. SSH is a common target for attack due to its widespread use and access to shell on the instance. Restricting access to known IP addresses or IP ranges helps mitigate this risk by limiting who can attempt to connect to instances via SSH. This rule checks for OpenStack security groups that allow unrestricted ingress on port 22 and fails if any are found, encouraging the practice of least privilege access.

How to Fix

Resource: openstack_networking_secgroup_rule_v2

Ensure that the security group rule for SSH (port 22) ingress does not allow access from '0.0.0.0/0' (all IP addresses).

By specifying a known IP range for SSH access, this configuration adheres to best practices for securing SSH access, reducing the risk of unauthorized access to instances. [source,go]

resource "openstack_compute_secgroup_v2" "secgroup_1" { name = "my_secgroup" description = "my security group"

rule { from_port = 22 to_port = 22 ip_protocol = "tcp"

• cidr = "192.168.0.0/16" } }

---