NSG must not allow SSH from Internet

Critical Azure General nsg-nsg-allow-ssh-from

Applies to

Microsoft.Network/networkSecurityGroups

What CGPulse checks

A resource passes this rule when allowsSshFromInternet must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Restrict SSH (port 22) access to specific IP ranges to prevent brute-force attacks. In Azure Portal: NSG > Inbound security rules > restrict SSH source IPs. See: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Careful: Removing SSH rules may break remote access. Ensure VPN or Azure Bastion is configured first

CLI

az network nsg rule list --nsg-name {name} -g {rg} -o table

Terraform

resource "azurerm_network_security_rule" "deny_ssh_internet" {
  name                        = "deny-ssh-from-internet"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Tcp"
  destination_port_range      = "22"
  source_address_prefix       = "Internet"
  destination_address_prefix  = "*"
  source_port_range           = "*"
  resource_group_name         = "{rg}"
  network_security_group_name = "{name}"
}

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan