Ensure RDP access from the Internet is restricted in network security groups

ВысокийУровень 1Автоматическаяazure

Описание

Inbound RDP (3389) from any/Internet is continuously brute-forced. No Allow inbound rule in any NSG may combine a source of *, 0.0.0.0/0, Internet or ::/0 with a destination port range covering 3389. Read-only Azure CLI calls against the current subscription; credentials come from the CLI's normal sign-in (az login, a service principal or managed identity; select the subscription with az account set). A missing CLI or session fails the check.

Как проверяется

Метод проверки: Команда оболочки

shell

out=$(az network nsg list --query '[].securityRules[?access==`"Allow"` && direction==`"Inbound"`][].[name, sourceAddressPrefix, join(`","`, sourceAddressPrefixes || `[]`), destinationPortRange, join(`","`, destinationPortRanges || `[]`)]' -o tsv 2>/dev/null) || exit 1
printf '%s\n' "$out" | awk -F '\t' -v p=3389 '
function pub(s,   n, i, a) { n = split(s, a, ","); for (i = 1; i <= n; i++) if (a[i] == "*" || a[i] == "0.0.0.0/0" || a[i] == "Internet" || a[i] == "Any" || a[i] == "::/0") return 1; return 0 }
function hit(s,   n, i, a, b) { n = split(s, a, ","); for (i = 1; i <= n; i++) { if (a[i] == "*") return 1; if (split(a[i], b, "-") == 2) { if (p >= b[1] + 0 && p <= b[2] + 0) return 1 } else if (a[i] + 0 == p) return 1 } return 0 }
NF && (pub($2) || pub($3)) && (hit($4) || hit($5)) { n++; print "open: " $1 }
END { if (!n) print "compliant" }'

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Delete or narrow the listed rules (az network nsg rule update --source-address-prefixes <admin-cidr>, or az network nsg rule delete) and use Azure Bastion or just-in-time VM access for RDP.

Свойства

Операционные системы: Любая
Теги: azurenetwork
Источник: CIS Microsoft Azure Foundations Benchmark v6.0.0 - Networking - RDP access from the Internet evaluated and restricted (verify section number for your release)

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target azure