GCP-VM-instances-have-serial-port-access-enabled

Owned by naveen
Nov 02, 2021
1 min read

Severity: Low

Description: This control ensures 'Enable connecting to serial ports' is not enabled for VM Instance. Interacting with a serial port is often referred to as the serial console, which is like using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support. If you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address. Therefore, interactive serial console support should be disabled

Remediation Steps:

Perform following To ensure Enable connecting to serial ports is not enabled for VM Instance:

Google Cloud Console:

  1. Sign in to GCP Console https://console.cloud.google.com.

  2. Go to Compute Engine.

  3. Go to VM instances.

  4. Click on the Specific VM.

  5. Click Edit.

  6. Unselect Enable connecting to serial ports below Remote access block

  7. Click Save

gcloud command-line tool:

Use the below command to disable:

gcloud compute instances add-metadata [VM_INSTANCE_NAME]=[region] --metadata=serial-port-enable=false

OR

gcloud compute instances add-metadata [VM_INSTANCE_NAME]=[region] --metadata=serial-port-enable=0

Important:

Kubernetes Cluster nodes are also listed as VM instances. And the Edit option for these nodes is disabled.

Reference:

Blue Hexagon Proprietary