Quick Info
| Plugin Title | Open All Ports |
| Cloud | AZURE |
| Category | Network Security Groups |
| Description | Ensures Network Security Groups do not expose all ports to the public |
| More Info | While some ports such as HTTP and HTTPS are required to be open to the public to function properly, almost all services should be restricted to known IP addresses. |
| AZURE Link | https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group |
| Recommended Action | Restrict ports to known IP addresses |
Detailed Remediation Steps
- Log into the Microsoft Azure Management Console.
- Select the “Search resources, services, and docs” option at the top and search for Network security groups.
- Select the “Network security group” that needs to be verified.
- Click on the “Name” of the selected “Network security group” to access the port configurations.
- In the “Overview” tab scroll down the page and check the “Inbound security rules.”
- On the “Inbound security rules” page under the “Settings”, please verify all the ports apart from HTTP/HTTPS are not open to public and if any port such as SSH is open to the public then it’s not as per the recommendation of Azure best practices.
- Repeat steps number 2 - 6 to verify other “Network security group.”
- Navigate to the “Network security group” and select the security group that needs to modify for restricting the other ports to specific IP Address.
- Scroll down the left navigation panel and choose “Inbound security rules” under “Settings."
- Click on the “SSH or any” protocol in the “Name” column and under “Source” select the “IP Address” from the dropdown menu and enter the “Source IP addresses/CIDR ranges” as per the requirement, select the required Protocol and Action, enter the priority and click on the “Save” option at the top panel.
- Repeat steps number 8 - 10 to restrict ports to known IP addresses .