No Serial Port | Vulnerability Database

Disable serial port connectivity for all instances

When serial port access is enabled, the access is not governed by network security rules meaning the port can be exposed publicly.

Impact

Unrestricted network access to the serial console of the instance

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Log into the Google Cloud Platform Console.
Scroll down the left navigation panel and choose the “Compute Engine” to select the “VM Instances” option.
On the “VM Instances” page, select the VM instance which needs to be verified.
On the “VM instance details” page, scroll down and check “Enable connecting to serial ports” is enabled or not for VM instances.
Repeat steps number 2 - 4 to verify other VM instances in the network.
Navigate to “Compute Engine”, choose the “VM instances” and select the “VM instance” which needs to disabled “Connecting to serial ports” for VM instances.
On the “VM instance details” page, select the “Edit” button at the top.
On the “VM instance details - Edit page”, unselect the checkbox next to “Enable connecting to serial ports.”
Click on the “Save” button to make the changes.
Repeat steps number 6 - 9 to ensure the “Enable Connecting to Serial Ports” option is disabled for all compute instances.

Disable serial port access

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


 resource "google_service_account" "default" {
   account_id   = "service_account_id"
   display_name = "Service Account"
 }
 
 resource "google_compute_instance" "default" {
   name         = "test"
   machine_type = "e2-medium"
   zone         = "us-central1-a"
 
   tags = ["foo", "bar"]
 
   boot_disk {
     initialize_params {
       image = "debian-cloud/debian-9"
     }
   }
 
   // Local SSD disk
   scratch_disk {
     interface = "SCSI"
   }
 
   network_interface {
     network = "default"
 
     access_config {
       // Ephemeral IP
     }
   }
 
   metadata = {
     serial-port-enable = false
   }
 
   metadata_startup_script = "echo hi > /test.txt"
 
   service_account {
     # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
     email  = google_service_account.default.email
     scopes = ["cloud-platform"]
   }
 }
 

Remediation Links

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#