Résumé
ONYEDIKACHI BERNARDCLOUD · DEVSECOPS · AI
RésuméGet in touch
CASE 08SECURE COMPUTE

Exposed EC2 Management Port

An EC2 instance had SSH open to the whole internet. I confirmed Session Manager already gave a safer way in, removed the public SSH rule, and proved I could still administer the instance.

Status: REMEDIATED · VERIFIED

DOMAIN
Secure compute
PLATFORM
AWS EC2, Systems Manager
SEVERITY
High
OUTCOME
No public management port

TOOLS

AWS CLIAmazon EC2AWS Security GroupsAWS Systems Manager Session Manager
RESULT
BEFORESSH open to 0.0.0.0/0
AFTERSession Manager only
01

Objective

I set out to find out whether the instance's management port was open to the internet and whether a safer way to manage it already existed, then remove the public SSH access without losing admin access.

02

Scenario

The instance's security group allowed TCP/22 from 0.0.0.0/0, so any host on the internet could try to SSH in. Before changing anything I wanted to know whether Session Manager was already available as an alternative.

03

What I found

security-group-inboundPUBLIC
Protocol: TCP
Port:     22
Source:   0.0.0.0/0
FINDING 01HIGH

SSH open to the internet

The attached security group had one inbound rule exposing the management interface to everyone.

Anyone could attempt to authenticate against SSH, which is an initial access path if credentials leak or SSH has a weakness. The instance was already registered with Systems Manager (Ping: Online), so the public rule was not needed to keep management access.

04

What I did

  1. Found the instance

    I identified the running instance by its lab tag and pulled its attached security group.

  2. Read the inbound rules

    I found TCP/22 open to 0.0.0.0/0.

  3. Checked the alternative first

    I confirmed the SSM agent was online before touching the rule, so I would not lock myself out.

  4. Revoked public SSH

    I removed the 0.0.0.0/0 rule on port 22.

EVIDENCE

BASH
aws ec2 revoke-security-group-ingress --group-id "$SG_ID" \
  --ip-permissions '[{"IpProtocol":"tcp","FromPort":22,"ToPort":22,"IpRanges":[{"CidrIp":"0.0.0.0/0"}]}]'
# Return: true
05

Validation

The security group's inbound rules came back empty, and I opened a Session Manager session to the instance:

TEXT
Inbound rules after:   []
Session Manager:       sh-5.2$ whoami
                       ssm-user
06

Before and after

CONTROLBEFOREAFTER
SSH port 22OpenRemoved
SSH source0.0.0.0/0No public rule
Internet-facing managementExposedRemoved
Admin accessPublic SSHSession Manager
07

What I recommend

  1. 01Do not expose management ports to the internet when another way in exists.
  2. 02Use Session Manager for admin access where it fits.
  3. 03If direct access is needed, restrict it to known sources.
  4. 04Review security groups regularly for public management ports.

“Because Session Manager was already working, I could remove public SSH without losing admin access to the instance.”

WHAT I LEARNED

SKILLS IT PROVES

  • Cloud Security
  • EC2 Security
  • Security Group Configuration
  • AWS Systems Manager
  • Network Security
  • Attack Surface Reduction
  • Vulnerability Remediation
  • AWS CLI
View my labs on GitHub