Port security is enabled on networks and ports

networking_port_security_disabled

Service: networkingSeverity: high

OfficialBuilt-inVerified

Categories:trust-boundariesvulnerabilities

Resource Type:OS::Neutron::Net

OpenStack networks and ports are evaluated to verify that port security is enabled (port_security_enabled=True). Port security prevents MAC and IP spoofing by enforcing anti-spoofing rules. When disabled, instances can forge source addresses, bypass network isolation, and enable man-in-the-middle attacks. Disabling is sometimes required for NFV/SR-IOV use cases.

Prowler prowler-provider-openstack

Risk

Disabled port security allows MAC/IP spoofing attacks, bypassing network isolation. Attackers can intercept traffic via ARP poisoning (MITM attacks), bypass security group rules by forging source IPs, and attack other tenants in multi-tenant environments (cross-tenant data exfiltration). Security groups cannot be enforced properly. Violates compliance requirements (PCI-DSS, HIPAA, SOC 2).

Run this check with Prowler

Run in Prowler Cloud

Run

prowler openstack --checks networking_port_security_disabled

Recommendation

Enable port security on all networks and ports to prevent MAC and IP spoofing attacks. For legitimate NFV or SR-IOV use cases requiring disabled port security, deploy on isolated networks with compensating controls like network-level ACLs and monitoring. Use allowed-address-pairs instead of disabling port security when additional IPs are needed.

Remediation

Terraform

# Terraform: ensure port security is enabled on networks and ports

# GOOD: Network with port security enabled (default)
resource "openstack_networking_network_v2" "secure_network" {
  name           = "prod-app-network"
  admin_state_up = true
  # port_security_enabled defaults to true - explicitly set for clarity
  # No need to specify if keeping default
}

# GOOD: Explicitly enable port security
resource "openstack_networking_network_v2" "explicit_security" {
  name           = "prod-web-network"
  admin_state_up = true
  # Explicitly enable port security
  # Note: Check if your OpenStack provider version supports this attribute
}

# GOOD: Port with port security enabled
resource "openstack_networking_port_v2" "secure_port" {
  name           = "instance-port-01"
  network_id     = openstack_networking_network_v2.secure_network.id
  admin_state_up = true
  
  # Port security enabled by default
  # Apply security groups
  security_group_ids = [
    openstack_networking_secgroup_v2.web_sg.id,
  ]
  
  fixed_ip {
    subnet_id = openstack_networking_subnet_v2.subnet.id
  }
}

# BAD: Port with port security disabled (security risk)
# resource "openstack_networking_port_v2" "insecure_port" {
#   name           = "nfv-port-01"
#   network_id     = openstack_networking_network_v2.network.id
#   admin_state_up = true
#   
#   # DANGEROUS: Disabling port security allows MAC/IP spoofing
#   port_security_enabled = false
#   
#   # Security groups cannot be enforced without port security
#   # security_group_ids = []  # Must be empty when port_security_enabled = false
# }

# ACCEPTABLE: Disabled port security for legitimate NFV use case with documentation
resource "openstack_networking_port_v2" "nfv_port" {
  name           = "nfv-vrouter-port"
  network_id     = openstack_networking_network_v2.nfv_network.id
  admin_state_up = true
  
  # Port security disabled for NFV virtual router
  # JUSTIFICATION: SR-IOV network function requires promiscuous mode
  # COMPENSATING CONTROLS: 
  #   - Isolated network (no shared tenants)
  #   - Network-level ACLs via provider firewall
  #   - Monitoring for anomalous traffic patterns
  port_security_enabled = false
  
  # Cannot use security groups with disabled port security
  security_group_ids = []
}

# Create dedicated isolated network for resources requiring disabled port security
resource "openstack_networking_network_v2" "nfv_network" {
  name           = "nfv-isolated-network"
  admin_state_up = true
  # Isolated network - not shared with other projects
  shared = false
}

# Validation: Check port security is enabled
resource "null_resource" "validate_port_security" {
  depends_on = [openstack_networking_port_v2.secure_port]
  
  provisioner "local-exec" {
    command = <<-EOF
      # Verify port security is enabled
      PORT_SECURITY=$(openstack port show ${openstack_networking_port_v2.secure_port.id} -f json | jq -r '.port_security_enabled')
      if [ "$PORT_SECURITY" != "true" ]; then
        echo "ERROR: Port security is disabled on ${openstack_networking_port_v2.secure_port.id}"
        exit 1
      fi
      echo "✓ Port security validation passed"
    EOF
  }
}

Other

1Navigate to Project > Network > Networks

2For each network, click Edit Network

3Ensure the Port Security checkbox is checked

4Click Save

5Navigate to Project > Network > Networks > Ports

6For each port, click Edit Port

7Ensure the Port Security checkbox is checked

8Click Save

Check Code

"""OpenStack Network Port Security Check."""

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.networking.networking_client import (
    networking_client,
)


class networking_port_security_disabled(Check):
    """Ensure port security is enabled on networks and ports."""

    def execute(self) -> List[CheckReportOpenStack]:
        """Execute networking_port_security_disabled check.

        Iterates over all networks and ports and verifies that port security
        is enabled to prevent MAC/IP spoofing attacks.

        Returns:
            list[CheckReportOpenStack]: List of findings for each network/port.
        """
        findings: List[CheckReportOpenStack] = []

        # Check networks
        for network in networking_client.networks:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=network)
            report.resource_id = network.id
            report.resource_name = network.name
            report.region = network.region

            if not network.port_security_enabled:
                report.status = "FAIL"
                report.status_extended = f"Network {network.name} ({network.id}) has port security disabled, which allows MAC and IP address spoofing attacks."
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Network {network.name} ({network.id}) has port security enabled."
                )

            findings.append(report)

        # Check ports
        for port in networking_client.ports:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=port)
            report.resource_id = port.id
            report.resource_name = port.name or f"port-{port.id[:8]}"
            report.region = port.region

            if not port.port_security_enabled:
                report.status = "FAIL"
                report.status_extended = f"Port {report.resource_name} ({port.id}) on network {port.network_id} has port security disabled, which allows MAC and IP address spoofing."
            else:
                report.status = "PASS"
                report.status_extended = f"Port {report.resource_name} ({port.id}) has port security enabled."

            findings.append(report)

        return findings