{"id":19498,"date":"2015-05-05T23:06:26","date_gmt":"2015-05-05T17:36:26","guid":{"rendered":"http:\/\/www.tothenew.com\/blog\/?p=19498"},"modified":"2015-07-09T11:14:47","modified_gmt":"2015-07-09T05:44:47","slug":"continuing-with-boto-find-security-group-having-port-22-open-for-all","status":"publish","type":"post","link":"https:\/\/www.tothenew.com\/blog\/continuing-with-boto-find-security-group-having-port-22-open-for-all\/","title":{"rendered":"Continuing with Boto: Find security group having port 22 open for all"},"content":{"rendered":"

Consider a use case where in any team members<\/a> have opened port 22 for\u00a00.0.0.0\/0<\/b> inside an EC2 security group and forgot, which is a big security concern for the Instances.<\/p>\n

So I have written a script using python boto library which scans all the security groups of running \/ stopped instances and sends an email to all stakeholders on daily\/weekly basis if port 22 is open for all. This script uses SNS API calls to send an email if defined rule matches.<\/p>\n

This script has few prerequisites<\/p>\n

1) Create an SNS topic and configure subscription.<\/strong><\/p>\n

Once you create SNS topic, you get an end point that you need to configure in scripts.<\/p>\n

2) Configure IAM User \/ Role with required policy. <\/strong><\/p>\n

[js]
\nimport sys
\nimport boto
\nfrom boto import ec2
\nfrom boto import sns
\nconnection=ec2.connect_to_region("region-name")
\nconnSNS = boto.sns.connect_to_region("region-name")
\nsg=connection.get_all_security_groups()<\/p>\n

listOfInstances=""
\nmessages="Following Instances have port 22 open"<\/p>\n

def getTag(instanceId):
\n reservations=connection.get_all_instances(filters={‘instance_id’:instanceId})
\n for r in reservations:
\n for i in r.instances:
\n return i.tags[‘Name’]<\/p>\n

try:
\n for securityGroup in sg:
\n for rule in securityGroup.rules:
\n global instanceId;
\n if (rule.from_port==’22’ and rule.to_port == ’22’) and ‘0.0.0.0\/0’ in str(rule.grants):
\n for instanceid in securityGroup.instances():
\n instanceId=str(instanceid)
\n listOfInstances += "Instance Name : " + getTag(instanceId.split(‘:’)[1]) + "\\t State:" + instanceid.state + "\\t SecurityGroup:" +securityGroup.name + "\\n"
\n connSNS.publish(topic=’SNS-topic-arn-endpoint’,message = messages + "\\n" + listOfInstances, subject=’ProjectName : Server List with Port 22 Open’)<\/p>\n

except :
\n print ‘Some Error occurred : ‘
\n print sys.exc_info()
\n connSNS.publish(topic=’SNS-topic-arn-endpoint’,message = sys.exc_info(), subject=’script ended with error’)<\/p>\n

[\/js]<\/p>\n

You can schedule this script as a cron on a daily basis to get the report over the email. You can download these scripts from our github profile AWS-Boto-Scripts.<\/a><\/p>\n

Leave a comment if you have any questions regarding this article.<\/p>\n","protected":false},"excerpt":{"rendered":"

Consider a use case where in any team members have opened port 22 for\u00a00.0.0.0\/0 inside an EC2 security group and forgot, which is a big security concern for the Instances. So I have written a script using python boto library which scans all the security groups of running \/ stopped instances and sends an email […]<\/p>\n","protected":false},"author":100,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":10,"footnotes":""},"categories":[1174],"tags":[248,1694,521,553],"class_list":["post-19498","post","type-post","status-publish","format-standard","hentry","category-aws-2","tag-aws","tag-aws-ec2-monitoring","tag-custom-security","tag-ssh"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t