lacework-global-266
4.3 Enable Block Project-Wide SSH Keys for VM Instances (Automated)
Profile Applicability
• Level 1
Description
Best practices recommend using Instance specific SSH keys instead of using common/shared project-wide SSH keys to access Instances.
Rationale
Project-wide SSH keys are stored in Compute/Project-meta-data. Project wide SSH keys can be used to login into all the instances within project. Using project-wide SSH keys eases the SSH key management but if compromised, poses the security risk which can impact all the instances within project. It is recommended to use Instance specific SSH keys which can limit the attack surface if the SSH keys are compromised.
Impact
Users already having Project-wide ssh key pairs and using third party SSH clients will lose access to the impacted Instances. For Project users using gcloud or GCP Console based SSH option, no manual key creation and distribution is required and will be handled by GCE (Google Compute Engine) itself. To access Instance using third party SSH clients Instance specific SSH key pairs need to be created and distributed to the required users.
Audit
From Console:
Go to the
VM instances
page by visiting https://console.cloud.google.com/compute/instances. It will list all the instances in your project.For every instance, click on the name of the instance.
Under
SSH Keys
, ensureBlock project-wide SSH keys
is selected.
From Command Line:
- List the instances in your project and get details on each instance:
gcloud compute instances list --format=json
- Ensure
key: block-project-ssh-keys
is set tovalue: 'true'
.
Remediation
From Console:
Go to the
VM instances
page by visiting: https://console.cloud.google.com/compute/instances. It lists all the instances in your project.Click the name of the Impacted instance.
Click
Edit
in the toolbar.Under SSH Keys, go to the
Block project-wide SSH keys
checkbox.To block users with project-wide SSH keys from connecting to this instance, select
Block project-wide SSH keys
.Click
Save
at the bottom of the page.Repeat steps for every impacted Instance.
From Command Line:
To block project-wide public SSH keys, set the metadata value to TRUE:
gcloud compute instances add-metadata <instance_name> --metadata block-project-ssh-keys=TRUE
References
https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys
https://cloud.google.com/sdk/gcloud/reference/topic/formats
Additional Information
It is not necessary to block project-wide SSH keys with OS Login enabled, as this ignores SSH keys in instance metadata.