Back to Checks
stackit

IaaS security groups do not allow unrestricted RDP access

iaas_security_group_rdp_unrestricted
Service: iaasSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Security groups should not allow unrestricted RDP access (port 3389) from the public internet (0.0.0.0/0 or ::/0). Unrestricted RDP access increases the attack surface and can lead to unauthorized access, brute force attacks, and potential system compromise.

Prowler logoProwlerprowler-provider-stackit

Risk

Allowing unrestricted RDP access from the internet exposes Windows servers to potential unauthorized access attempts, brute force attacks, ransomware, and security breaches. Attackers can exploit weak credentials or vulnerabilities.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler stackit --checks iaas_security_group_rdp_unrestricted

Recommendation

Restrict RDP access to specific IP addresses or ranges that require administrative access. Use bastion hosts or VPN connections for secure remote access instead of exposing RDP directly to the internet.

Remediation

Other

1In the StackIT Portal open Networking > Security Groups and select the affected security group. 2. Locate the ingress rule that allows TCP port 3389 from 0.0.0.0/0 or ::/0. 3. Delete that rule or edit its source to the specific IP ranges that require RDP access. 4. If administration from anywhere is required, expose RDP only through a bastion host or VPN instead of the public internet. 5. Re-run Prowler to confirm the finding is resolved.

Check Code

from prowler.lib.check.models import Check, CheckReportStackIT
from prowler.providers.stackit.services.iaas.iaas_client import iaas_client


class iaas_security_group_rdp_unrestricted(Check):
    """
    Check if IaaS security groups allow unrestricted RDP access.

    This check verifies that security groups do not allow RDP (port 3389)
    access from the public internet (0.0.0.0/0 or ::/0).
    """

    def execute(self):
        """
        Execute the check for all security groups in the StackIT project.

        Returns:
            list: A list of CheckReportStackIT findings
        """
        findings = []

        for security_group in iaas_client.security_groups:
            if not (iaas_client.scan_unused_services or security_group.in_use):
                continue
            report = CheckReportStackIT(
                metadata=self.metadata(),
                resource=security_group,
            )
            report.status = "PASS"
            report.status_extended = f"Security group {security_group.name} does not allow unrestricted RDP access."
            report.resource_id = security_group.id
            report.resource_name = security_group.name
            report.location = security_group.region

            for rule in security_group.rules:
                if (
                    rule.is_ingress()
                    and rule.is_tcp()
                    and rule.is_unrestricted()
                    and rule.includes_port(3389)
                ):
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Security group {security_group.name} allows unrestricted RDP access (port 3389) "
                        f"from {rule.get_ip_range_display()} via rule {rule.get_rule_display_name()}."
                    )
                    break

            findings.append(report)

        return findings

References