Skip to main content

Insecure Access Control

Fixing Insecure Access Control​

About Insecure Access Control

What is improper access control?​

Improper access control is a vulnerability that occurs when a system does not properly restrict or enforce access to resources, such as files, directories, network resources, or application functions.

Examples of improper access control vulnerabilities include:

  • Weak access controls: When access controls are weak or easily bypassed, attackers can gain access to sensitive resources or data by exploiting security weaknesses.
  • Insufficient authorization checks: When authorization checks are insufficient, it can allow unauthorized users to access sensitive data or resources, or to perform actions that they are not authorized to do.
  • Overly permissive access: When access controls are overly permissive, they can allow users to access resources or data that they do not need, increasing the risk of data breaches or other security incidents.

Check out these videos for a high-level explanation:

  • Missing function level access control

  • Missing object level access control

What is the impact of improper access control?​

Improper access control can lead to various security threats, such as:

  • Data breaches: Improper access control can allow attackers to access sensitive data, leading to data breaches, data loss, or unauthorized access to confidential information.
  • Unauthorized access to resources: Attackers can exploit improper access control to gain unauthorized access to resources, such as servers, databases, and applications.
  • Account takeover: Attackers can use improper access control to take over user accounts and gain access to sensitive data or resources.

How to prevent improper access control?​

Here are some measures that can help ensure proper access control:

  • Strong access controls: Implement strong access controls that restrict access to sensitive resources or data based on user roles and permissions.
  • Proper user authentication and authorization: Implement proper user authentication and authorization mechanisms to ensure that only authorized users can access sensitive data and resources.
  • Input validation and sanitization: Validate and sanitize user input before using it to access internal objects or data. Use regular expressions or input filters to remove or encode any special characters that could be used to access sensitive data or resources.
  • Least privilege: Use the principle of least privilege to restrict access to resources to only what is necessary for each user role. This can help prevent attackers from gaining access to resources that they do not need to access.
  • Regular security audits: Regularly audit your system for security vulnerabilities, including improper access control vulnerabilities. Use automated tools and manual testing to identify potential issues and fix them before they can be exploited.

References​

Taxonomies​

Explanation & Prevention​

Training​

Network Security Group With Unrestricted Access To RDP​

Port 3389 (Remote Desktop) should not be exposed to the Internet.

Rule-specific references:

Option A: Make sure the default RDP port is not open​

Make sure the security rules do not allow access to RDP port 3389.

  1. Locate one of the following vulnerable patterns:

    Vulnerable security rule access "Allow" pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "security group",
          "type": "Microsoft.Network/networkSecurityGroups",
          "apiVersion": "2020-11-01",
          "location": "location1",
          "tags": {},
          "properties": {
            "securityRules": [
              {
                "id": "id",
                "properties": {
                  "description": "access to RDP",
                  "protocol": "Tcp",
                  "sourcePortRange": "*",
                  "destinationPortRange": "3389",
                  "sourceAddressPrefix": "*",
                  "destinationAddressPrefix": "*",
                  "access": "Allow",
                  "priority": 301,
                  "direction": "Inbound"
                },
                "name": "security rule"
              }
            ]
          },
          "resources": []
        }
      ],
      "outputs": {}
    }

    Vulnerable security rule destinationPortRanges contains the RDP port pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "sample/securitygroup",
          "type": "Microsoft.Network/networkSecurityGroups/securityRules",
          "apiVersion": "2020-11-01",
          "properties": {
            "description": "access to RDP",
            "protocol": "Tcp",
            "sourcePortRange": "*",
            "destinationPortRanges": [
              "3333-3389"
            ],
            "sourceAddressPrefix": "*",
            "destinationAddressPrefix": "*",
            "access": "Allow",
            "priority": 100,
            "direction": "Inbound"
          }
        }
      ],
      "outputs": {}
    }

    Vulnerable security rule destinationPortRanges contains the RDP port pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "securitygroup",
          "type": "Microsoft.Network/networkSecurityGroups",
          "apiVersion": "2020-11-01",
          "location": "location1",
          "tags": {},
          "properties": {},
          "resources": [
            {
              "type": "securityRules",
              "apiVersion": "2020-11-01",
              "properties": {
                "description": "access to RDP",
                "protocol": "Tcp",
                "sourcePortRange": "*",
                "destinationPortRanges": [
                  "3333-3389"
                ],
                "sourceAddressPrefix": "*",
                "destinationAddressPrefix": "*",
                "access": "Allow",
                "priority": 100,
                "direction": "Inbound"
              },
              "name": "sr"
            }

          ]
        }
      ],
      "outputs": {}
    }

    Vulnerable security rule access "Allow" pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "security group",
              "type": "Microsoft.Network/networkSecurityGroups",
              "apiVersion": "2020-11-01",
              "location": "location1",
              "tags": {},
              "properties": {
                "securityRules": [
                  {
                    "id": "id",
                    "properties": {
                      "description": "access to RDP",
                      "protocol": "Tcp",
                      "sourcePortRange": "*",
                      "destinationPortRange": "3389",
                      "sourceAddressPrefix": "*",
                      "destinationAddressPrefix": "*",
                      "access": "Allow",
                      "priority": 301,
                      "direction": "Inbound"
                    },
                    "name": "security rule"
                  }
                ]
              },
              "resources": []
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

    Vulnerable security rule destinationPortRanges contains the RDP port pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "sample/securitygroup",
              "type": "Microsoft.Network/networkSecurityGroups/securityRules",
              "apiVersion": "2020-11-01",
              "properties": {
                "description": "access to RDP",
                "protocol": "Tcp",
                "sourcePortRange": "*",
                "destinationPortRanges": [
                  "3333-3389"
                ],
                "sourceAddressPrefix": "*",
                "destinationAddressPrefix": "*",
                "access": "Allow",
                "priority": 100,
                "direction": "Inbound"
              }
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

    Vulnerable security rule destinationPortRanges contains the RDP port pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "securitygroup",
              "type": "Microsoft.Network/networkSecurityGroups",
              "apiVersion": "2020-11-01",
              "location": "location1",
              "tags": {},
              "properties": {},
              "resources": [
                {
                  "type": "securityRules",
                  "apiVersion": "2020-11-01",
                  "properties": {
                    "description": "access to RDP",
                    "protocol": "Tcp",
                    "sourcePortRange": "*",
                    "destinationPortRanges": [
                      "3333-3389"
                    ],
                    "sourceAddressPrefix": "*",
                    "destinationAddressPrefix": "*",
                    "access": "Allow",
                    "priority": 100,
                    "direction": "Inbound"
                  },
                  "name": "sr"
                }
              ]
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

  2. Modify the config to something like the following:

    Replacement security rule access "Deny" pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "security group",
          "type": "Microsoft.Network/networkSecurityGroups",
          "apiVersion": "2020-11-01",
          "location": "location1",
          "tags": {},
          "properties": {
            "securityRules": [
              {
                "id": "id",
                "properties": {
                  "description": "access to RDP",
                  "protocol": "Tcp",
                  "sourcePortRange": "*",
                  "destinationPortRange": "3389",
                  "sourceAddressPrefix": "*",
                  "destinationAddressPrefix": "*",
                  "access": "Deny",
                  "priority": 301,
                  "direction": "Inbound"
                },
                "name": "security rule"
              }
            ]
          },
          "resources": []
        }
      ],
      "outputs": {}
    }

    Replacement security rule destinationPortRanges does not contain the RDP port pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "sample/securitygroup",
          "type": "Microsoft.Network/networkSecurityGroups/securityRules",
          "apiVersion": "2020-11-01",
          "properties": {
            "description": "access",
            "protocol": "Tcp",
            "sourcePortRange": "*",
            "destinationPortRanges": [
              "4030-5100"
            ],
            "sourceAddressPrefix": "*",
            "destinationAddressPrefix": "*",
            "access": "Allow",
            "priority": 100,
            "direction": "Inbound"
          }
        }
      ],
      "outputs": {}
    }

    Replacement security rule destinationPortRanges does not contain the RDP port pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "securitygroup",
          "type": "Microsoft.Network/networkSecurityGroups",
          "apiVersion": "2020-11-01",
          "location": "location1",
          "tags": {},
          "properties": {},
          "resources": [
            {
              "type": "securityRules",
              "apiVersion": "2020-11-01",
              "properties": {
                "description": "access",
                "protocol": "Tcp",
                "sourcePortRange": "*",
                "destinationPortRanges": [
                  "6634"
                ],
                "sourceAddressPrefix": "*",
                "destinationAddressPrefix": "*",
                "access": "Allow",
                "priority": 100,
                "direction": "Inbound"
              },
              "name": "sr"
            }

          ]
        }
      ],
      "outputs": {}
    }

    Replacement security rule access "Deny" pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "security group",
              "type": "Microsoft.Network/networkSecurityGroups",
              "apiVersion": "2020-11-01",
              "location": "location1",
              "tags": {},
              "properties": {
                "securityRules": [
                  {
                    "id": "id",
                    "properties": {
                      "description": "access to RDP",
                      "protocol": "Tcp",
                      "sourcePortRange": "*",
                      "destinationPortRange": "3389",
                      "sourceAddressPrefix": "*",
                      "destinationAddressPrefix": "*",
                      "access": "Deny",
                      "priority": 301,
                      "direction": "Inbound"
                    },
                    "name": "security rule"
                  }
                ]
              },
              "resources": []
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

    Replacement security rule destinationPortRanges does not contain the RDP port pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "sample/securitygroup",
              "type": "Microsoft.Network/networkSecurityGroups/securityRules",
              "apiVersion": "2020-11-01",
              "properties": {
                "description": "access",
                "protocol": "Tcp",
                "sourcePortRange": "*",
                "destinationPortRanges": [
                  "4030-5100"
                ],
                "sourceAddressPrefix": "*",
                "destinationAddressPrefix": "*",
                "access": "Allow",
                "priority": 100,
                "direction": "Inbound"
              }
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

    Replacement security rule destinationPortRanges does not contain the RDP port pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "securitygroup",
              "type": "Microsoft.Network/networkSecurityGroups",
              "apiVersion": "2020-11-01",
              "location": "location1",
              "tags": {},
              "properties": {},
              "resources": [
                {
                  "type": "securityRules",
                  "apiVersion": "2020-11-01",
                  "properties": {
                    "description": "access",
                    "protocol": "Tcp",
                    "sourcePortRange": "*",
                    "destinationPortRanges": [
                      "6634"
                    ],
                    "sourceAddressPrefix": "*",
                    "destinationAddressPrefix": "*",
                    "access": "Allow",
                    "priority": 100,
                    "direction": "Inbound"
                  },
                  "name": "sr"
                }
              ]
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

  3. Test it

  4. Ship it 🚢 and relax 🌴

Network Security Group With Unrestricted Access To SSH​

Only expose port 22 (SSH) to the Internet if there is a valid reason and you have configured SSH correctly with a secure configuration.

Rule-specific references:

Option A: Close SSH port 22​

The easiest approach is to simply close the SSH port 22 not have the port open if this is practical.

Then this rule is triggered if a security rule exists with all of the following values:

  • properties.access == "Allow"
  • properties.protocol == "Tcp"
  • properties.direction == "Inbound"
  • properties.destinationPortRange or properties.destinationPortRanges contains 22
  • properties.sourceAddressPrefix or properties.sourceAddressPrefixes has an IP address specifier that allows all IP addresses

  1. Locate one of the following vulnerable patterns:

    Vulnerable pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "security group",
          "type": "Microsoft.Network/networkSecurityGroups",
          "apiVersion": "2020-11-01",
          "location": "location1",
          "tags": {},
          "properties": {
            "securityRules": [
              {
                "id": "id",
                "properties": {
                  "description": "access to SSH",
                  "protocol": "Tcp",
                  "sourcePortRange": "*",
                  "destinationPortRange": "22",
                  "sourceAddressPrefix": "*",
                  "destinationAddressPrefix": "*",
                  "access": "Allow",
                  "priority": 301,
                  "direction": "Inbound"
                },
                "name": "security rule"
              },
               {
                "id": "id2",
                "properties": {
                  "description": "access to RDP",
                  "protocol": "Tcp",
                  "sourcePortRange": "*",
                  "destinationPortRange": "3389",
                  "sourceAddressPrefix": "*",
                  "destinationAddressPrefix": "*",
                  "access": "Deny",
                  "priority": 301,
                  "direction": "Inbound"
                },
                "name": "security rule2"
              }
            ]
          },
          "resources": []
        }
      ],
      "outputs": {}
    }

    Vulnerable pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "sample/securitygroup",
          "type": "Microsoft.Network/networkSecurityGroups/securityRules",
          "apiVersion": "2020-11-01",
          "properties": {
            "description": "access to SSH",
            "protocol": "Tcp",
            "sourcePortRange": "*",
            "destinationPortRanges": [
              "22-23"
            ],
            "sourceAddressPrefix": "*",
            "destinationAddressPrefix": "*",
            "access": "Allow",
            "priority": 100,
            "direction": "Inbound"
          }
        }
      ],
      "outputs": {}
    }

    Vulnerable pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "securitygroup",
          "type": "Microsoft.Network/networkSecurityGroups",
          "apiVersion": "2020-11-01",
          "location": "location1",
          "tags": {},
          "properties": {},
          "resources": [
            {
              "type": "securityRules",
              "apiVersion": "2020-11-01",
              "properties": {
                "description": "access to SSH",
                "protocol": "Tcp",
                "sourcePortRange": "*",
                "destinationPortRanges": [
                  "22-23"
                ],
                "sourceAddressPrefix": "*",
                "destinationAddressPrefix": "*",
                "access": "Allow",
                "priority": 100,
                "direction": "Inbound"
              },
              "name": "sr"
            }

          ]
        }
      ],
      "outputs": {}
    }

    Vulnerable nested within properties.template pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "security group",
              "type": "Microsoft.Network/networkSecurityGroups",
              "apiVersion": "2020-11-01",
              "location": "location1",
              "tags": {},
              "properties": {
                "securityRules": [
                  {
                    "id": "id",
                    "properties": {
                      "description": "access to SSH",
                      "protocol": "Tcp",
                      "sourcePortRange": "*",
                      "destinationPortRange": "22",
                      "sourceAddressPrefix": "*",
                      "destinationAddressPrefix": "*",
                      "access": "Allow",
                      "priority": 301,
                      "direction": "Inbound"
                    },
                    "name": "security rule"
                  }
                ]
              },
              "resources": []
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

    Vulnerable nested within properties.template pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "sample/securitygroup",
              "type": "Microsoft.Network/networkSecurityGroups/securityRules",
              "apiVersion": "2020-11-01",
              "properties": {
                "description": "access to SSH",
                "protocol": "Tcp",
                "sourcePortRange": "*",
                "destinationPortRanges": [
                  "22-23"
                ],
                "sourceAddressPrefix": "*",
                "destinationAddressPrefix": "*",
                "access": "Allow",
                "priority": 100,
                "direction": "Inbound"
              }
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

    Vulnerable nested within properties.template pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "securitygroup",
              "type": "Microsoft.Network/networkSecurityGroups",
              "apiVersion": "2020-11-01",
              "location": "location1",
              "tags": {},
              "properties": {},
              "resources": [
                {
                  "type": "securityRules",
                  "apiVersion": "2020-11-01",
                  "properties": {
                    "description": "access to SSH",
                    "protocol": "Tcp",
                    "sourcePortRange": "*",
                    "destinationPortRanges": [
                      "22-23"
                    ],
                    "sourceAddressPrefix": "*",
                    "destinationAddressPrefix": "*",
                    "access": "Allow",
                    "priority": 100,
                    "direction": "Inbound"
                  },
                  "name": "sr"
                }

              ]
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

  2. Modify the config to something like the following:

    Replacement pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "security group",
          "type": "Microsoft.Network/networkSecurityGroups",
          "apiVersion": "2020-11-01",
          "location": "location1",
          "tags": {},
          "properties": {
            "securityRules": [
              {
                "id": "id",
                "properties": {
                  "description": "access to SSH",
                  "protocol": "Tcp",
                  "sourcePortRange": "*",
                  "destinationPortRange": "22",
                  "sourceAddressPrefix": "*",
                  "destinationAddressPrefix": "*",
                  "access": "Deny",
                  "priority": 301,
                  "direction": "Inbound"
                },
                "name": "security rule"
              }
            ]
          },
          "resources": []
        }
      ],
      "outputs": {}
    }

    Replacement pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "sample/securitygroup",
          "type": "Microsoft.Network/networkSecurityGroups/securityRules",
          "apiVersion": "2020-11-01",
          "properties": {
            "description": "access",
            "protocol": "Tcp",
            "sourcePortRange": "*",
            "destinationPortRanges": [
              "4030-5100"
            ],
            "sourceAddressPrefix": "*",
            "destinationAddressPrefix": "*",
            "access": "Allow",
            "priority": 100,
            "direction": "Inbound"
          }
        }
      ],
      "outputs": {}
    }

    Replacement pattern:

    {
      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
      "contentVersion": "2.0.0.0",
      "apiProfile": "2019-03-01-hybrid",
      "parameters": {},
      "variables": {},
      "functions": [],
      "resources": [
        {
          "name": "securitygroup",
          "type": "Microsoft.Network/networkSecurityGroups",
          "apiVersion": "2020-11-01",
          "location": "location1",
          "tags": {},
          "properties": {},
          "resources": [
            {
              "type": "securityRules",
              "apiVersion": "2020-11-01",
              "properties": {
                "description": "access",
                "protocol": "Tcp",
                "sourcePortRange": "*",
                "destinationPortRanges": [
                  "6634"
                ],
                "sourceAddressPrefix": "*",
                "destinationAddressPrefix": "*",
                "access": "Allow",
                "priority": 100,
                "direction": "Inbound"
              },
              "name": "sr"
            }

          ]
        }
      ],
      "outputs": {}
    }

    Replacement nested within properties.template pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "security group",
              "type": "Microsoft.Network/networkSecurityGroups",
              "apiVersion": "2020-11-01",
              "location": "location1",
              "tags": {},
              "properties": {
                "securityRules": [
                  {
                    "id": "id",
                    "properties": {
                      "description": "access to SSH",
                      "protocol": "Tcp",
                      "sourcePortRange": "*",
                      "destinationPortRange": "22",
                      "sourceAddressPrefix": "*",
                      "destinationAddressPrefix": "*",
                      "access": "Deny",
                      "priority": 301,
                      "direction": "Inbound"
                    },
                    "name": "security rule"
                  }
                ]
              },
              "resources": []
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

    Replacement nested within properties.template pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "sample/securitygroup",
              "type": "Microsoft.Network/networkSecurityGroups/securityRules",
              "apiVersion": "2020-11-01",
              "properties": {
                "description": "access",
                "protocol": "Tcp",
                "sourcePortRange": "*",
                "destinationPortRanges": [
                  "4030-5100"
                ],
                "sourceAddressPrefix": "*",
                "destinationAddressPrefix": "*",
                "access": "Allow",
                "priority": 100,
                "direction": "Inbound"
              }
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

    Replacement nested within properties.template pattern:

    {
      "properties": {
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "2.0.0.0",
          "apiProfile": "2019-03-01-hybrid",
          "parameters": {},
          "variables": {},
          "functions": [],
          "resources": [
            {
              "name": "securitygroup",
              "type": "Microsoft.Network/networkSecurityGroups",
              "apiVersion": "2020-11-01",
              "location": "location1",
              "tags": {},
              "properties": {},
              "resources": [
                {
                  "type": "securityRules",
                  "apiVersion": "2020-11-01",
                  "properties": {
                    "description": "access",
                    "protocol": "Tcp",
                    "sourcePortRange": "*",
                    "destinationPortRanges": [
                      "6634"
                    ],
                    "sourceAddressPrefix": "*",
                    "destinationAddressPrefix": "*",
                    "access": "Allow",
                    "priority": 100,
                    "direction": "Inbound"
                  },
                  "name": "sr"
                }

              ]
            }
          ],
          "outputs": {}
        },
        "parameters": {}
      },
      "kind": "template",
      "type": "Microsoft.Blueprint/blueprints/artifacts",
      "name": "myTemplate"
    }

  3. Test it

  4. Ship it 🚢 and relax 🌴

Option B: Harden SSH Sufficiently to Resist Attacks​

There are a good number of things you can do to harden your SSH.

If you decide to keep the SSH port open consider the following:

  • Restrict which IP addresses can access the port by specifying only the addresses you need to properties.sourceAddressPrefix or properties.sourceAddressPrefixes
  • You can also configure which hosts can access SSH by configuring the following files:
    • /etc/hosts.allow
    • /etc/hosts.deny
  • In the following file: /etc/ssh/sshd_config you can:
    • Restrict which users can log in by way of allow list
    • Restrict which users can log in by way of deny list
    • Restrict root logins
    • Use public key authentication
Last updated on by Stefan Streichsbier