NSG blocks Internet ingress to port 22 (SSH)

Check ID: network_security_group_ingress_from_internet_to_ssh_port
Provider: Oracle Cloud (OCI)
Service: network
Severity: HIGH
Categories: internet-exposed
Resource type: NetworkSecurityGroup

What this check verifies

Network security groups with ingress from 0.0.0.0/0 exposing SSH are identified. This includes rules that explicitly permit TCP 22, use all protocols, or define TCP port ranges that encompass 22.

Risk

Public SSH access enables Internet-wide probing, brute force, and credential stuffing that can grant shell access. Compromise allows lateral movement, data exfiltration (confidentiality), unauthorized changes or malware (integrity), and service disruption or ransomware-driven lockouts (availability).

Recommendation

Enforce least privilege: limit SSH in NSG rules to trusted CIDRs or private networks. Prefer bastion access (e.g., OCI Bastion) or VPN/private connectivity over direct Internet exposure. Use key-based auth, disable PasswordAuthentication, log and monitor access, and segment workloads for defense in depth.

Remediation

CLI
Terraform
Dashboard steps

oci network nsg rules remove —nsg-id <nsg-ocid> —security-rule-ids ’[“<rule-ocid>”]’

# Restrict SSH so it's not from 0.0.0.0/0
resource "oci_core_network_security_group_security_rule" "<example_resource_name>" {
  network_security_group_id = "<example_resource_id>"
  direction                 = "INGRESS"
  protocol                  = "6"                         # TCP
  source                    = "10.0.0.0/8"               # CRITICAL: not 0.0.0.0/0; limits SSH to internal range

  tcp_options {
    destination_port_range {
      min = 22  # CRITICAL: explicitly defines SSH port
      max = 22
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = network_security_group_ingress_from_internet_to_ssh_port. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

NSG blocks Internet ingress to port 3389 (RDP)Security list blocks Internet ingress to RDP port 3389

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires