Azure Audit Networksecurity Security Group Unrestricted

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of unrestricted Oracle Database Access in Azure, you can follow the below steps:

Login to Azure portal (https://portal.azure.com/)
Navigate to the Azure SQL Database service.
Select the database that needs to be remediated.
In the left-hand menu, select "Firewalls and virtual networks".
Under "Firewalls", select "Add client IP".
This will add your client IP to the allowed IP addresses list. If you want to allow access from a specific IP range, you can add that range as well.
Under "Virtual networks", select "Add existing virtual network".
This will allow you to add an existing virtual network to the allowed networks list.
Once you have added the necessary IP addresses and networks, click "Save" to apply the changes.
Finally, ensure that the "Allow access to Azure services" option is set to "OFF" to prevent unrestricted access to the database.

By following these steps, you can remediate the misconfiguration of unrestricted Oracle Database Access in Azure and ensure that your database is secure.

Using CLI

The following are the step-by-step instructions to remediate the "Unrestricted Oracle Database Access" misconfiguration in Azure using Azure CLI:

Open the Azure CLI and log in to your Azure account.
Run the following command to list all the Oracle database servers in your subscription:
```
az mysql server list
```
Identify the server that has unrestricted access.
Run the following command to update the firewall rules for the identified server:
```
az mysql server firewall-rule update --name <firewall-rule-name> --server <server-name> --resource-group <resource-group-name> --start-ip-address <start-ip-address> --end-ip-address <end-ip-address>
```
Replace the following parameters in the command:
- <firewall-rule-name>: The name of the firewall rule that needs to be updated.
- <server-name>: The name of the Oracle database server.
- <resource-group-name>: The name of the resource group that contains the Oracle database server.
- <start-ip-address>: The starting IP address of the allowed IP range.
- <end-ip-address>: The ending IP address of the allowed IP range.
Run the following command to verify that the firewall rule has been updated:
```
az mysql server firewall-rule list --server <server-name> --resource-group <resource-group-name>
```
Replace the following parameters in the command:
- <server-name>: The name of the Oracle database server.
- <resource-group-name>: The name of the resource group that contains the Oracle database server.
Verify that the firewall rule has been updated and that access to the Oracle database is now restricted.
Repeat the above steps for all the Oracle database servers in your subscription that have unrestricted access.

Using Python

To remediate the unrestricted Oracle Database Access issue in Azure using Python, you can follow these steps:

Connect to your Azure account using the Azure Python SDK.
Retrieve the list of Azure Database for Oracle servers in your subscription.
For each server, retrieve the list of firewall rules associated with it.
For each firewall rule, check if it allows unrestricted access to the server.
If a firewall rule allows unrestricted access, update the firewall rule to restrict access to a specific IP range or subnet.

Here's a sample Python code that demonstrates how to remediate the unrestricted Oracle Database Access issue in Azure:

# Import the required libraries
from azure.identity import DefaultAzureCredential
from azure.mgmt.rdbms.oracle import OracleManagementClient

# Create a credential object
credential = DefaultAzureCredential()

# Create a management client object
oracle_client = OracleManagementClient(credential, subscription_id)

# Retrieve the list of Oracle servers in the subscription
servers = oracle_client.servers.list()

# For each server, retrieve the list of firewall rules
for server in servers:
    firewall_rules = oracle_client.firewall_rules.list_by_server(server.resource_group, server.name)
    
    # For each firewall rule, check if it allows unrestricted access
    for rule in firewall_rules:
        if rule.start_ip_address == "0.0.0.0" and rule.end_ip_address == "255.255.255.255":
            # Update the firewall rule to restrict access to a specific IP range or subnet
            updated_rule = rule
            updated_rule.start_ip_address = "x.x.x.x" # Replace x.x.x.x with the start IP address of the IP range or subnet
            updated_rule.end_ip_address = "y.y.y.y" # Replace y.y.y.y with the end IP address of the IP range or subnet
            oracle_client.firewall_rules.create_or_update(server.resource_group, server.name, updated_rule.name, updated_rule)

Note: You will need to replace subscription_id with your Azure subscription ID, and x.x.x.x and y.y.y.y with the appropriate IP addresses for your environment.

Using Terraform

resource "azurerm_network_security_group" "ORACLE_DB_NSG" {
  name                = "ORACLE_DB_NSG"                          # replace with your NSG name
  location            = azurerm_resource_group.RG.location        # replace with your RG
  resource_group_name = azurerm_resource_group.RG.name            # replace with your RG

  security_rule {
    name                       = "allow-oracle-from-trusted"
    priority                   = 100                              # adjust to fit your rule set
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"

    # Replace the example CIDRs below with your trusted IP ranges only
    source_address_prefixes = [
      "TRUSTED_CIDR_1",    # e.g. "203.0.113.10/32" for a single admin IP
      "TRUSTED_CIDR_2",    # e.g. "198.51.100.0/24" for a corporate range
    ]

    destination_port_range    = "1521"
    destination_address_prefix = "*"
  }

  # Ensure you DO NOT have any other rule that allows:
  # - direction = "Inbound"
  # - access    = "Allow"
  # - protocol  = "Tcp" or "*"
  # - destination_port_range = "1521" or a range including it
  # - source_address_prefix / source_address_prefixes = "*" or "0.0.0.0/0"
}

This change is an in-place update to the NSG rules and does not force NSG replacement; Azure will update the rule on apply.

Verification: terraform plan should show the existing inbound rule on port 1521 changing its source_address_prefix/source_address_prefixes from "*"/"0.0.0.0/0" to the specific TRUSTED_CIDR_* values (or the old wide-open rule being removed and the new restricted rule being added).

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation