logo

Database

Terraform Unrestricted Ssh Access

Description

Detects unrestricted SSH access (port 22) in Azure Network Security Groups and security rules defined in Terraform configurations. Allowing SSH access from any IP address (0.0.0.0/0) exposes systems to potential unauthorized access and brute force attacks.

Weakness:

157 - Unrestricted access between network segments

Category: Access Subversion

Detection Strategy

    • Identifies Azure NSG resources ('azurerm_network_security_group') and security rules ('azurerm_network_security_rule') in Terraform code

    • Checks if any security rule allows inbound traffic on port 22 (SSH)

    • Verifies if the source address prefix is set to '*', '0.0.0.0/0', 'Internet', or 'any'

    • Reports a vulnerability if SSH port is open to unrestricted source IP addresses

Vulnerable code example

# Azure NSG rule allowing SSH access from any source
resource "azurerm_network_security_rule" "vulnerable_rule" {
  name                        = "Allow_SSH_From_Anywhere"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range          = "*"...

✅ Secure code example

resource "azurerm_network_security_rule" "secure_rule" {
  name                        = "Allow_SSH_From_Trusted_IPs"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range          = "*"
  destination_port_range     = "22"...