For security reasons, I want to close port 22 (ssh) of my VM that is on GCP.
Currently, if I execute the command telnet xx.xx.xxx.xxx 22
the server responds to me:
Trying xx.xx.xxx.xxx...
Connected to xx.xx.xxx.xxx.
Escape character is '^]'.
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5
I tried configuring correctly the firewall rules that are in contact with the VM: Remove "apply to all" from the target in the "default-allow-ssh" rule and create a rule called "close-ssh" that denies all connections to the port 22 since 0.0.0.0/4.
Image here: https://i.stack.imgur.com/8LGkW.png
Also I verified that running the sudo iptables -L
command on the server does not find any rules that expose port 22. The output was as follows:
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (3 references)
target prot opt source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target prot opt source destination
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-ISOLATION-STAGE-2 (3 references)
target prot opt source destination
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Y al ejecutar el comando nmap -p 22 xx.xx.xxx.xxx
tengo el siguiente output:
Starting Nmap 7.80 ( https://nmap.org ) at 2023-05-10 09:56 -03
Nmap scan report for xx.xx.xxx.xxx.bc.googleusercontent.com (xx.xx.xxx.xxx)
Host is up (0.32s latency).
PORT STATE SERVICE
22/tcp open ssh
Nmap done: 1 IP address (1 host up) scanned in 0.67 seconds