forked from aquasecurity/cloudsploit
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathopenSMTP.js
More file actions
49 lines (39 loc) · 1.71 KB
/
Copy pathopenSMTP.js
File metadata and controls
49 lines (39 loc) · 1.71 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
var async = require('async');
var helpers = require('../../../helpers/google');
module.exports = {
title: 'Open SMTP',
category: 'VPC Network',
domain: 'Network Access Control',
description: 'Determines if TCP port 25 for SMTP is open to the public',
more_info: 'While some ports such as HTTP and HTTPS are required to be open to the public to function properly, more sensitive services such as SMTP should be restricted to known IP addresses.',
link: 'https://cloud.google.com/vpc/docs/using-firewalls',
recommended_action: 'Restrict TCP port 25 to known IP addresses.',
apis: ['firewalls:list', 'projects:get'],
run: function(cache, settings, callback) {
var results = [];
var source = {};
var regions = helpers.regions();
async.each(regions.firewalls, function(region, rcb){
let firewalls = helpers.addSource(
cache, source, ['firewalls', 'list', region]);
if (!firewalls) return rcb();
if (firewalls.err || !firewalls.data) {
helpers.addResult(results, 3, 'Unable to query firewall rules', region, null, null, firewalls.err);
return rcb();
}
if (!firewalls.data.length) {
helpers.addResult(results, 0, 'No firewall rules found', region);
return rcb();
}
let ports = {
'tcp': [25]
};
let service = 'SMTP';
helpers.findOpenPorts(firewalls.data, ports, service, region, results, cache, callback, source);
rcb();
}, function(){
// Global checking goes here
callback(null, results, source);
});
}
};