A security group acts as a virtual firewall that controls inbound and outbound traffic for ECS instances. Improperly configured security group rules can create serious security vulnerabilities. You can use the Security Group Check feature in Cloud Firewall to quickly identify and fix risky rules in ECS security groups. This helps you manage security groups more securely and efficiently. The Security Group Check feature supports both basic security groups and advanced security groups.
Security group check items
This table describes the check items in the Cloud Firewall Security Group Check feature. You can enable or disable these checks based on your business requirements. You cannot modify these checks.
|
Check item |
Security risk |
Recommendations |
|
Remote management port exposure on Linux instances |
Port 22 allows access from any IP address, exposing the associated Linux servers to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to port 22. If your business requires access to this port, restrict access to trusted source IP addresses or use Bastionhost for secure remote management. For more information, see What is Bastionhost?. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on Windows instances |
Port 3389 allows access from any IP address, exposing the associated Windows servers to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to port 3389. If your business requires access to this port, restrict access to trusted source IP addresses or use Bastionhost for secure remote management. For more information, see What is Bastionhost?. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on DB2 databases |
Port 50000 allows access from any IP address, exposing the associated DB2 databases to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to port 50000. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
An ECS instance is associated with too many security groups |
An ECS instance is associated with three or more security groups, which increases management complexity and the risk of misconfiguration. |
As a best practice, associate an ECS instance with two or fewer security groups. For more information, see Security group overview. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on Elasticsearch |
Ports 9200 and 9300 allow access from any IP address, exposing the associated Elasticsearch clusters to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to ports 9200 and 9300. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on Hadoop YARN |
Port 8088 allows access from any IP address, exposing the associated Hadoop YARN clusters to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to port 8088. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on Hadoop |
Ports 50070 and 50030 allow access from any IP address, exposing the associated Hadoop clusters to brute-force attacks. |
On the Security groups page of the ECS console, configure rules to deny public access to ports 50070 and 50030. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on MongoDB |
Port 27017 allows access from any IP address, exposing the associated MongoDB databases to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to port 27017. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on MySQL |
Port 3306 allows access from any IP address, exposing the associated MySQL databases to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to port 3306. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on Oracle |
Port 1521 allows access from any IP address, exposing the associated Oracle databases to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to port 1521. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on PostgreSQL |
Port 5432 allows access from any IP address, exposing the associated PostgreSQL databases to brute-force attacks. |
On the Security groups page of the ECS console, configure rules to deny public access to port 5432. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on Redis |
Port 6379 allows access from any IP address, exposing the associated Redis databases to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to port 6379. Additionally, on the Protection Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on SQL Server |
Port 1433 allows access from any IP address, exposing the associated SQL Server databases to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to port 1433. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on Spark |
Port 6066 allows access from any IP address, exposing the associated Spark clusters to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to port 6066. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Remote management port exposure on Splunk |
Ports 8089 and 8090 allow access from any IP address, exposing the associated Splunk instances to brute-force attacks. |
On the Security Group page of the ECS console, configure rules to deny public access to ports 8089 and 8090. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
|
Unrestricted Inbound Access |
A security group allows inbound traffic from any IP address on any port, posing a severe intrusion risk. |
Restrict access to only the ports required by your business and limit the range of allowed source IP addresses. Additionally, on the Prevention Configuration page of the Cloud Firewall console, enable the threat intelligence and basic protection features. |
Check security group risks
-
Log on to the Cloud Firewall console.
-
In the left-side navigation pane, choose .
-
On the Security Group Optimizer page, click Obtain Latest Check Results.
The check takes 1 to 5 minutes to complete.
NoteThe Security Group Check feature performs a static analysis of your security group rules. The results may not cover all potential port-related risks. You can go to the Internet Exposure page to view all check results for your ports and understand their actual exposure status.
After the check is complete, the page displays two metrics: Number of risk items and Number of at-risk servers.
View check results
In the Check Result Details area, view the details of the detected security group risks. The details include Risk Level, Check Item, At-risk Security Groups/Servers, and Check Item Status. A high risk level indicates that a security group allows inbound traffic from any IP address on any port, which poses a severe intrusion threat.
To enable or disable a check item, use the Check Item Status switch. Disabling a check item excludes it from the scan.
Typical high-risk check items include Remote management port exposure on Linux instances, Remote management port exposure on Windows instances, and Unrestricted Inbound Access.
Remediate high-risk check items
-
Find the check item you want to fix and click Fixing Details in the Actions column.
You can also click the number in the At-risk Security Groups/Servers column. A number greater than 0 indicates a high-risk vulnerability that requires immediate attention. This action also navigates you to the Fixing Details page.
-
On the Fixing Details page, find the security group you want to fix, and click Fix in Security Group in the Actions column.
Alternatively, click a security group ID in the At-risk Security Group ID/Name column to open the Security Group page of the ECS console, where you can fix the risky security group rules.
WarningImproperly configured security group rules can lead to serious security incidents. The Fixing Details page provides Fixing Suggestions for at-risk security groups. We recommend that you modify the risky security group rules based on these Fixing Suggestions as soon as possible.