Sensitive port is exposed to small public network Ce produit n'est pas pris en charge par le
site Datadog que vous avez sélectionné. (
).
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter .
Id: terraform-azure-sensitive-port-is-exposed-to-small-public-network
Provider: Azure
Platform: Terraform
Severity: Medium
Category: Networking and Firewall
Learn More Description Allowing sensitive ports, such as port 23 (Telnet) or port 110 (POP3), to be open on public-facing network security groups exposes your resources to potential attacks that target these outdated and insecure protocols. Attackers can exploit these open ports to gain unauthorized access, intercept unencrypted communications, or conduct brute-force attacks against your infrastructure. To mitigate this risk, network security rules should explicitly deny traffic on sensitive ports, as in the following secure configuration:
resource "azurerm_network_security_rule" "secure_example" {
name = "deny_telnet"
priority = 100
direction = "Inbound"
access = "Deny"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "23"
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group.example.name
network_security_group_name = azurerm_network_security_group.example.name
}
Compliant Code Examples resource "azurerm_network_security_rule" "negative1" {
name = "example"
priority = 100
direction = "Inbound"
access = "Deny"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "23"
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative2" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Icmp"
source_port_range = "*"
destination_port_range = "23-34"
source_address_prefix = "*"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative3" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "8-174"
source_address_prefix = "0.0.0.0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative4" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "23-196"
source_address_prefix = "192.168.0.0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative5" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "23"
source_address_prefix = "/1"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative6" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "43"
source_address_prefix = "/0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative7" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Icmp"
source_port_range = "*"
destination_port_range = "23"
source_address_prefix = "internet"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative8" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "22, 24,49-67"
source_address_prefix = "any"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative9" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Icmp"
source_port_range = "*"
destination_port_range = "23"
source_address_prefix = "/0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative10" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "23 , 69"
source_address_prefix = "0.0.1.0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "negative11" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "2,310"
source_address_prefix = "0.0.0.0"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
Non-Compliant Code Examples resource "azurerm_network_security_rule" "positive1" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "UDP"
source_port_range = "*"
destination_port_range = "61621"
source_address_prefix = "/26"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive2" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "23-34"
source_address_prefix = "1.1.1.1/25"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive3" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "21-23"
source_address_prefix = "/26"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive4" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "23"
source_address_prefix = "0.0.0.0/27"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive5" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "UDP"
source_port_range = "*"
destination_port_range = "23,245"
source_address_prefix = "34.15.11.3/28"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive6" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "23"
source_address_prefix = "/29"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive7" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "UDP"
source_port_range = "*"
destination_port_range = "22-64, 94"
source_address_prefix = "10.0.0.0/28"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive8" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "TCP"
source_port_range = "*"
destination_port_range = "14, 23, 48"
source_address_prefix = "12.12.12.12/27"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive9" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "12, 23-24,46"
source_address_prefix = "/26"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
resource "azurerm_network_security_rule" "positive10" {
name = "example"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "46-146, 18-36, 1-2, 3"
source_address_prefix = "1.2.3.4/25"
destination_address_prefix = "*"
resource_group_name = azurerm_resource_group . example . name
network_security_group_name = azurerm_network_security_group . example . name
}
