Back to Checks
stackit

IaaS security groups do not allow unrestricted SSH access

iaas_security_group_ssh_unrestricted
Service: iaasSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Security groups should not allow unrestricted SSH access (port 22) from the public internet (0.0.0.0/0 or ::/0). Unrestricted SSH access increases the attack surface and can lead to unauthorized access, brute force attacks, and potential system compromise.

Prowler logoProwlerprowler-provider-stackit

Risk

Allowing unrestricted SSH access from the internet exposes servers to potential unauthorized access attempts, brute force attacks, and security breaches. Attackers can scan for and exploit weak credentials or vulnerabilities.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler stackit --checks iaas_security_group_ssh_unrestricted

Recommendation

Restrict SSH access to specific IP addresses or ranges that require administrative access. Use bastion hosts or VPN connections for secure remote access instead of exposing SSH directly to the internet.

Remediation

Other

1In the StackIT Portal open Networking > Security Groups and select the affected security group. 2. Locate the ingress rule that allows TCP port 22 from 0.0.0.0/0 or ::/0. 3. Delete that rule or edit its source to the specific IP ranges that require SSH access. 4. If administration from anywhere is required, expose SSH only through a bastion host or VPN instead of the public internet. 5. Re-run Prowler to confirm the finding is resolved.

Check Code

from prowler.lib.check.models import Check, CheckReportStackIT
from prowler.providers.stackit.services.iaas.iaas_client import iaas_client


class iaas_security_group_ssh_unrestricted(Check):
    """
    Check if IaaS security groups allow unrestricted SSH access.

    This check verifies that security groups do not allow SSH (port 22)
    access from the public internet (0.0.0.0/0 or ::/0).
    """

    def execute(self):
        """
        Execute the check for all security groups in the StackIT project.

        Returns:
            list: A list of CheckReportStackIT findings
        """
        findings = []

        for security_group in iaas_client.security_groups:
            if not (iaas_client.scan_unused_services or security_group.in_use):
                continue
            report = CheckReportStackIT(
                metadata=self.metadata(),
                resource=security_group,
            )
            report.status = "PASS"
            report.status_extended = f"Security group {security_group.name} does not allow unrestricted SSH access."
            report.resource_id = security_group.id
            report.resource_name = security_group.name
            report.location = security_group.region

            for rule in security_group.rules:
                if (
                    rule.is_ingress()
                    and rule.is_tcp()
                    and rule.is_unrestricted()
                    and rule.includes_port(22)
                ):
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Security group {security_group.name} allows unrestricted SSH access (port 22) "
                        f"from {rule.get_ip_range_display()} via rule {rule.get_rule_display_name()}."
                    )
                    break

            findings.append(report)

        return findings

References