Skip to content

Commit f8159ff

Browse files
kshrutiklytran2000
kshrutik
and
lytran2000
authored
Release/v1.8.0 (#106)
* Initial commit for ec2 close port for 1433, 1521, 20, 21, 23, 27017, … (#93) * Initial commit for ec2 close port for 1433, 1521, 20, 21, 23, 27017, 3306, 5439, 5601, 8080, 9200 and 9300 * Checking in unit test and tox.ini, made modification to remove common pkg from ec2_close_port_20.py * Checking in README with addition aws close port rules * Update README with correct port names for the new scripts * PLA-26195 - Handled PrincipalNotFound Exception in sql auditing job (#98) * PLA-24844 - Remediation job to restrict default security group access (#85) * PLA-24844 - Remediation job to restrict default security group access * PLA-24844 - Remediation job to restrict default security group access * Updated the remediation job code * PLA-25429 - Remediation job to set password reuse prevention policy (#89) * PLA-25429 - Remediation job to set password reuse prevention policy * PLA-25429 - Updated unit test * Updated the remediation job code * PLA-25428 - Remediation Job to set minimum password length (#90) * PLA-25430 - Remediation Job to delete expired server certificate (#96) * Initial commit for kinesis_encrypt_stream (#97) * Initial commit for kinesis_encrypt_stream * modified to add a return and exception to kinesis_encrypt_stream.py and unit testcases for remediate * remove print * update README.md * update README.md * remove format in kinesis_encrypt_stream.py * update README with a correct instruction to run the script and add a missing error loggin Co-authored-by: Shrutika Kulkarni <73834811+kshrutik@users.noreply.github.com> * PLA-26855 - Updated azure remediation jobs to wait for the poller result (#99) * PLA-26855 - Updated azure remediation jobs to wait for the poller result * PLA-26855 - Update azure jobs to poll continuously and log the status * Initial commit for aws 3 jobs: ebs_private_snapshot, rds_enable_versi… (#101) * Initial commit for aws 3 jobs: ebs_private_snapshot, rds_enable_version_update, rds_remove_public_endpoint * Update ebs_private_snapshot.py * Incorporated comments and inputs from PR review * Update README.md * Update README.md * Update README.md * Update README.md * Update README.md * PLA-29176 - Fix remediation jobs for port rules (#102) * PLA-29176 - Fix remediation jobs for port rules * PLA-29176 - updated requirements * PLA-29176 - Updated the public instance port remediation jobs * PLA-29176 - Fixed readme file * PLA-29176 - Fixed comments * PLA-29176 - Updated all the AWS port rule remediation jobs * PLA-29176 - Fixed requirements-dev file * PLA-29176 - Added comments * PLA-29459 - Update Readme and tox file (#104) * PLA-29459 - Update Readme and tox file * PLA-29459 - Updated readme * Fixed requirements file (#105) Co-authored-by: lytran2000 <44222483+lytran2000@users.noreply.github.com>
1 parent c958afc commit f8159ff

File tree

198 files changed

+6550
-563
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

198 files changed

+6550
-563
lines changed

‎README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,25 @@ The table below lists all the supported jobs with their links.
134134
| 21. | 688d093c-3b8d-11eb-adc1-0242ac120002 | S3 bucket should allow only HTTPS requests | [aws-s3-bucket-policy-allow-https](remediation_worker/jobs/aws_s3_bucket_policy_allow_https) |
135135
| 22. | 09639b9d-98e8-493b-b8a4-916775a7dea9 | SQS queue policy should restricted access to required users | [aws-sqs-queue-publicly-accessible](remediation_worker/jobs/aws_sqs_queue_publicly_accessible) |
136136
| 23. | 1ec4a1f2-3e08-11eb-b378-0242ac130002 | Network ACL should restrict administration ports (3389 and 22) from public access | [aws-ec2-administration-ports-ingress-allowed](remediation_worker/jobs/aws_ec2_administration_ports_ingress_allowed) |
137+
| 24. | ce603728-d631-4bae-8657-c22da6e5944e | Kinesis data stream should be encrypted | [kinesis-encrypt-stream](remediation_worker/jobs/kinesis_encrypt_stream) |
138+
| 25. | 5c8c263d7a550e1fb6560c39 | EC2 instance should restrict public access to FTP data port (20) | [ec2-close-port-20](remediation_worker/jobs/ec2_close_port_20) |
139+
| 26. | 4823ede0-7bed-4af0-a182-81c2ada80203 | EC2 instance should restrict public access to Kibana (5601) | [ec2-close-port-5601](remediation_worker/jobs/ec2_close_port_5601) |
140+
| 27. | 5c8c26427a550e1fb6560c41 | EC2 instance should restrict public access to MySQL server port (3306) | [ec2-close-port-3306](remediation_worker/jobs/ec2_close_port_3306) |
141+
| 28. | 5c8c26417a550e1fb6560c3e | EC2 instance should restrict public access to Oracle SQL port (1521) | [ec2-close-port-1521](remediation_worker/jobs/ec2_close_port_1521) |
142+
| 29. | 5c8c26417a550e1fb6560c3d | EC2 instance should restrict public access to SQL Server port (1433) | [ec2-close-port-1433](remediation_worker/jobs/ec2_close_port_1433) |
143+
| 30. | 5c8c263e7a550e1fb6560c3b | EC2 instance should restrict public access to Telnet port (23) | [ec2-close-port-23](remediation_worker/jobs/ec2_close_port_23) |
144+
| 31. | 5c8c263d7a550e1fb6560c3a | EC2 instance should restrict public access to FTP port (21) | [ec2-close-port-21](remediation_worker/jobs/ec2_close_port_21) |
145+
| 32. | 04700175-adbe-49e1-bc7a-bc9605597ce2 | EC2 instance should restrict public access to Elasticsearch ports (9200,9300) | [ec2-close-port-9200_9300](remediation_worker/jobs/ec2_close_port_9200_9300) |
146+
| 33. | 5c8c26427a550e1fb6560c40 | EC2 instance should restrict public access to MongoDB port (27017) | [ec2-close-port-27017](remediation_worker/jobs/ec2_close_port_27017) |
147+
| 34. | 5c8c26407a550e1fb6560c3c | EC2 instance should restrict public access to TCP port (8080) | [ec2-close-port-8080](remediation_worker/jobs/ec2_close_port_8080) |
148+
| 35. | 5c8c26447a550e1fb6560c44 | EC2 instance should restrict public access to Redshift port (5439) | [ec2-close-port-5439](remediation_worker/jobs/ec2_close_port_5439) |
149+
| 36. | 2cdb8877-7ac3-4483-9ed0-1e792171d125 | EBS volume snapshot should be private | [ebs-private-snapshot](remediation_worker/jobs/ebs_private_snapshot) |
150+
| 37. | 5c8c26467a550e1fb6560c48 | RDS instance should restrict public access | [rds-remove-public-endpoint](remediation_worker/jobs/rds_remove_public_endpoint) |
151+
| 38. | 5c8c264a7a550e1fb6560c4c | RDS should have automatic minor version upgrades enabled | [rds-enable-version-update](remediation_worker/jobs/rds_enable_version_update) |
152+
| 39. | 5c8c25f37a550e1fb6560bca | EC2 VPC default security group should restrict all access | [aws-ec2-default-security-group-traffic](remediation_worker/jobs/aws_ec2_default_security_group_traffic) |
153+
| 40. | 5c8c260b7a550e1fb6560bf4 | IAM password policy should set a minimum length | [aws-iam-password-policy-min-length](remediation_worker/jobs/aws_iam_password_policy_min_length) |
154+
| 41. | 5c8c26107a550e1fb6560bfc | IAM password policy should prevent password reuse | [aws-iam-password-reuse-prevention](remediation_worker/jobs/aws_iam_password_reuse_prevention) |
155+
| 42. | 7fe4eb28-3b82-11eb-adc1-0242ac120002 | IAM server certificates that are expired should be removed | [aws-iam-server-certificate-expired](remediation_worker/jobs/aws_iam_server_certificate_expired) |
137156

138157
## Contributing
139158
The Secure State team welcomes welcomes contributions from the community. If you wish to contribute code and you have not signed our contributor license agreement (CLA), our bot will update the issue when you open a Pull Request. For any questions about the CLA process, please refer to our [FAQ](https://cla.vmware.com/faq).

‎remediation_worker/jobs/aws_ec2_administration_ports_ingress_allowed/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Network ACL should restrict administration ports (3389 and 22) from public acces
1414

1515
### Prerequisites
1616

17-
The provided AWS credential must have access to `ec2:DeleteNetworkAcl`, `ec2:DescribeNetworkAcls` and `ec2:ReplaceNetworkAclEntry`.
17+
The provided AWS credential must have access to `ec2:DeleteNetworkAclEntry`, `ec2:DescribeNetworkAcls`.
1818

1919
You may find the latest example policy file [here](minimum_policy.json)
2020

‎remediation_worker/jobs/aws_ec2_administration_ports_ingress_allowed/aws_ec2_administration_ports_ingress_allowed.py‎

Lines changed: 29 additions & 208 deletions
Original file line numberDiff line numberDiff line change
@@ -61,201 +61,6 @@ def parse(self, payload):
6161
logging.info(return_dict)
6262
return return_dict
6363

64-
def create_list_of_rule_nos(self, network_acl_entries):
65-
"""Creates List of Rule Numbers in the Network Acl
66-
:param network_acl_entries: List of Network Acl entries.
67-
:type network_acl_id: str.
68-
:returns: List of Rule Numbers.
69-
:rtype: list.
70-
"""
71-
rule_nos = []
72-
for entry in network_acl_entries["Entries"]:
73-
rule_nos.append(entry["RuleNumber"])
74-
return rule_nos
75-
76-
def create_list_of_port_range(self, network_acl_entries):
77-
"""Creates List of Port Ranges in the Network Acl
78-
:param network_acl_entries: List of Network Acl entries.
79-
:type network_acl_id: str.
80-
:returns: List of Port Ranges.
81-
:rtype: list.
82-
"""
83-
port_ranges = []
84-
for entry in network_acl_entries["Entries"]:
85-
if "PortRange" not in entry:
86-
continue
87-
else:
88-
port = (entry["PortRange"]["From"], entry["PortRange"]["To"])
89-
port_ranges.append(port)
90-
return port_ranges
91-
92-
def check_if_nacl_exists(
93-
self, network_acl_entries, port_from, port_to, port_ranges
94-
):
95-
"""Checks if the Network ACL Entry already exists
96-
:param network_acl_entries: List of Network Acl entries.
97-
:param port_from: Port Range from.
98-
:param port_to: Port Range To.
99-
:param port_ranges: List of port ranges.
100-
:type network_acl_entries: list
101-
:type port_from: int
102-
:type port_to: int
103-
:type port_ranges: list
104-
:returns: Boolean value indicating if the entry with given port range already exists
105-
:rtype: bool
106-
"""
107-
for nacl_entry in network_acl_entries["Entries"]:
108-
if "PortRange" not in nacl_entry:
109-
continue
110-
elif (
111-
nacl_entry["PortRange"]["From"] == port_from
112-
and nacl_entry["PortRange"]["To"] == port_to
113-
):
114-
return True
115-
else:
116-
continue
117-
for port in port_ranges:
118-
if port[0] == port_from and port[1] == port_to:
119-
return True
120-
return False
121-
122-
def find_and_remove_port(
123-
self,
124-
network_acl_id,
125-
client,
126-
network_acl_entries,
127-
port_no,
128-
rule_nos,
129-
port_ranges,
130-
):
131-
"""Find and remove port 22 and 3389 from Network Acl Entries
132-
:param network_acl_id: Network Acl Id.
133-
:param client: Instance of the AWS boto3 client.
134-
:param network_acl_entries: List of Network Acl Entries.
135-
:param port_no: Port No. to remove.
136-
:param rule_nos: List of Rule Numbers.
137-
:type rule_nos: list.
138-
:type port_no: int.
139-
:type network_acl_entries: list.
140-
:type network_acl_id: str.
141-
:type client: object.
142-
:returns: None.
143-
:rtype: None.
144-
"""
145-
for entry in network_acl_entries["Entries"]:
146-
if (
147-
entry["Egress"] is False
148-
and entry["RuleAction"] == "allow"
149-
and entry["Protocol"] in ["6", "-1"]
150-
and entry["CidrBlock"] == "0.0.0.0/0"
151-
):
152-
if "PortRange" not in entry or entry["PortRange"] == {
153-
"From": port_no,
154-
"To": port_no,
155-
}:
156-
client.delete_network_acl_entry(
157-
Egress=False,
158-
NetworkAclId=network_acl_id,
159-
RuleNumber=entry["RuleNumber"],
160-
)
161-
elif (
162-
entry["PortRange"]["From"] < port_no
163-
and entry["PortRange"]["To"] == port_no
164-
):
165-
portrange_to = port_no - 1
166-
167-
if self.check_if_nacl_exists(
168-
network_acl_entries,
169-
entry["PortRange"]["From"],
170-
portrange_to,
171-
port_ranges,
172-
):
173-
client.delete_network_acl_entry(
174-
Egress=False,
175-
NetworkAclId=network_acl_id,
176-
RuleNumber=entry["RuleNumber"],
177-
)
178-
else:
179-
client.replace_network_acl_entry(
180-
CidrBlock=entry["CidrBlock"],
181-
Egress=entry["Egress"],
182-
NetworkAclId=network_acl_id,
183-
PortRange={
184-
"From": entry["PortRange"]["From"],
185-
"To": portrange_to,
186-
},
187-
Protocol=entry["Protocol"],
188-
RuleAction=entry["RuleAction"],
189-
RuleNumber=entry["RuleNumber"],
190-
)
191-
192-
port = (entry["PortRange"]["From"], portrange_to)
193-
port_ranges.append(port)
194-
elif (
195-
entry["PortRange"]["From"] < port_no
196-
and entry["PortRange"]["To"] > port_no
197-
):
198-
rule_no = entry["RuleNumber"] + 10
199-
200-
while rule_no in rule_nos:
201-
rule_no = rule_no + 10
202-
203-
portrange_to = port_no - 1
204-
205-
if self.check_if_nacl_exists(
206-
network_acl_entries,
207-
entry["PortRange"]["From"],
208-
portrange_to,
209-
port_ranges,
210-
):
211-
client.delete_network_acl_entry(
212-
Egress=False,
213-
NetworkAclId=network_acl_id,
214-
RuleNumber=entry["RuleNumber"],
215-
)
216-
else:
217-
client.replace_network_acl_entry(
218-
CidrBlock=entry["CidrBlock"],
219-
Egress=entry["Egress"],
220-
NetworkAclId=network_acl_id,
221-
PortRange={
222-
"From": entry["PortRange"]["From"],
223-
"To": portrange_to,
224-
},
225-
Protocol=entry["Protocol"],
226-
RuleAction=entry["RuleAction"],
227-
RuleNumber=entry["RuleNumber"],
228-
)
229-
230-
port = (entry["PortRange"]["From"], portrange_to)
231-
port_ranges.append(port)
232-
233-
portrange_from = port_no + 1
234-
235-
if self.check_if_nacl_exists(
236-
network_acl_entries,
237-
portrange_from,
238-
entry["PortRange"]["To"],
239-
port_ranges,
240-
):
241-
continue
242-
else:
243-
client.create_network_acl_entry(
244-
CidrBlock=entry["CidrBlock"],
245-
Egress=entry["Egress"],
246-
NetworkAclId=network_acl_id,
247-
PortRange={
248-
"From": portrange_from,
249-
"To": entry["PortRange"]["To"],
250-
},
251-
Protocol=entry["Protocol"],
252-
RuleAction=entry["RuleAction"],
253-
RuleNumber=rule_no,
254-
)
255-
rule_nos.append(rule_no)
256-
port = (portrange_from, entry["PortRange"]["To"])
257-
port_ranges.append(port)
258-
25964
def remediate(self, region, client, network_acl_id, cloud_account_id):
26065
"""Remove Network ACL Rules that allows public access to administration ports (3389 and 22)
26166
:param region: The buckets region
@@ -276,23 +81,39 @@ def remediate(self, region, client, network_acl_id, cloud_account_id):
27681
logging.info(
27782
"executing client.describe_network_acls to get network acl"
27883
)
84+
logging.info(" executing client.describe_network_acls")
85+
logging.info(f" NetworkAclId: {network_acl_id}")
86+
# List network acl details
27987
network_acl = client.describe_network_acls(
28088
NetworkAclIds=[network_acl_id]
28189
)
28290
network_acl_entries = network_acl["NetworkAcls"][0]
283-
#Create List of Rule Numbers
284-
rule_nos = self.create_list_of_rule_nos(network_acl_entries)
285-
#Create List of Port Ranges
286-
port_ranges = self.create_list_of_port_range(network_acl_entries)
287-
#Remove the port from the Network ACL entries
288-
self.find_and_remove_port(
289-
network_acl_id,
290-
client,
291-
network_acl_entries,
292-
port_no,
293-
rule_nos,
294-
port_ranges,
295-
)
91+
for entry in network_acl_entries["Entries"]:
92+
#Searching for the ingress nacl entries with RuleAction = allow,
93+
#protocol as tcp or all traffic, CidrBlock="0.0.0.0/0" and the
94+
#port range inclusive of port 22 and 3389
95+
if (
96+
entry["Egress"] is False
97+
and entry["RuleAction"] == "allow"
98+
and entry["Protocol"] in ["6", "-1"]
99+
and entry["CidrBlock"] == "0.0.0.0/0"
100+
and (
101+
"PortRange" not in entry
102+
or (
103+
entry["PortRange"]["From"] <= port_no
104+
and entry["PortRange"]["To"] >= port_no
105+
)
106+
)
107+
):
108+
# Delete nacl entry which provides public access to administration ports (3389 and 22)
109+
logging.info(" executing client.delete_network_acl_entry")
110+
logging.info(f" NetworkAclId: {network_acl_id}")
111+
logging.info(f" RuleNumber: {entry['RuleNumber']}")
112+
client.delete_network_acl_entry(
113+
Egress=False,
114+
NetworkAclId=network_acl_id,
115+
RuleNumber=entry["RuleNumber"],
116+
)
296117
logging.info("successfully completed remediation job")
297118
except Exception as e:
298119
logging.error(f"{str(e)}")

‎remediation_worker/jobs/aws_ec2_administration_ports_ingress_allowed/constraints.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,9 @@ py==1.9.0 \
2929
pluggy==0.13.1 \
3030
--hash=sha256:15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0 \
3131
--hash=sha256:966c145cd83c96502c3c3868f50408687b38434af77734af1e9ca461a4081d2d
32-
s3transfer==0.3.4 \
33-
--hash=sha256:1e28620e5b444652ed752cf87c7e0cb15b0e578972568c6609f0f18212f259ed \
34-
--hash=sha256:7fdddb4f22275cf1d32129e21f056337fd2a80b6ccef1664528145b72c49e6d2
32+
s3transfer==0.5.0 \
33+
--hash=sha256:50ed823e1dc5868ad40c8dc92072f757aa0e653a192845c94a3b676f4a62da4c \
34+
--hash=sha256:9c1dc369814391a6bda20ebbf4b70a0f34630592c9aa520856bf384916af2803
3535
six==1.15.0 \
3636
--hash=sha256:30639c035cdb23534cd4aa2dd52c3bf48f06e5f4a941509c8bafd8ce11080259 \
3737
--hash=sha256:8b74bedcbbbaca38ff6d7491d76f2b06b3592611af620f8426e82dddb04a5ced

‎remediation_worker/jobs/aws_ec2_administration_ports_ingress_allowed/minimum_policy.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"Effect": "Allow",
77
"Action": [
88
"ec2:DescribeNetworkAcls",
9-
"ec2:DeleteNetworkAcl"
9+
"ec2:DeleteNetworkAclEntry"
1010
],
1111
"Resource": "*"
1212
}

‎remediation_worker/jobs/aws_ec2_administration_ports_ingress_allowed/requirements.txt‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
boto3==1.16.60 \
2-
--hash=sha256:10e8d9b18a8ae15677e850c7240140b9539635a03098f01dfdd75b2042d15862 \
3-
--hash=sha256:aee742f2a2315244fb31a507f65d8809fcd0029508c0b12be8611ddd2075b666
4-
botocore==1.19.60 \
5-
--hash=sha256:423a1a9502bd7bc5db8c6e64f9374f64d8ac18e6b870278a9ff65f59d268cd58 \
6-
--hash=sha256:80dd615a34c7e2c73606070a9358f7b5c1cb0c9989348306c1c9ddff45bb6ebe
1+
boto3==1.18.4 \
2+
--hash=sha256:649ed1ca205f5ee0b0328d54580780aebc1a7a05681a24f6ee05253007ca48d8 \
3+
--hash=sha256:7079b40bd6621c54a0385a8fc11240cff4318a4d487292653e393e18254f5d94
4+
botocore==1.21.5 \
5+
--hash=sha256:0070c5e02b581db40ff5fd1b5e02db90ed88e7e861901894bd78fd998656da68 \
6+
--hash=sha256:bed34fe7a007180f4208b65515bab1755cdd9fcf2c6720f74ae7ecd2e707f4b7

0 commit comments

Comments
 (0)