Detections
Analytics

4.1.2 Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Ensure that no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP).

Rationale:

Azure SQL Server includes a firewall to block access to unauthorized connections. More granular IP addresses can be defined by referencing the range of addresses available from specific datacenters.

By default, for a SQL server, a Firewall exists with StartIp of 0.0.0.0 and EndIP of 0.0.0.0 allowing access to all the Azure services.

Additionally, a custom rule can be set up with StartIp of 0.0.0.0 and EndIP of 255.255.255.255 allowing access from ANY IP over the Internet.

In order to reduce the potential attack surface for a SQL server, firewall rules should be defined with more granular IP addresses by referencing the range of addresses available from specific datacenters.

Impact:

Disabling Allow Azure services and resources to access this server will break all connections to SQL server and Hosted Databases unless custom IP specific rules are added in Firewall Policy.

Solution

From Azure Portal

Go to SQL servers

For each SQL server

Click on Firewall and virtual networks

Set Allow Azure services and resources to access this server to No

Set firewall rules to limit access to only authorized connections

From Azure CLI
Disable default firewall rule Allow access to Azure services:

az sql server firewall-rule delete --resource-group <resource group> --server <sql server name> --name 'AllowAllWindowsAzureIps'

Remove a custom firewall rule:

az sql server firewall-rule delete --resource-group <resource group> --server <sql server name> --name <firewall rule name>

Create a firewall rule:

az sql server firewall-rule create --resource-group <resource group> --server <sql server name> --name <firewal lrule name> --start-ip-address '<IP Address other than 0.0.0.0>' --end-ip-address '<IP Address other than 0.0.0.0 or 255.255.255.255>'

Update a firewall rule:

az sql server firewall-rule update --resource-group <resource group> --server <sql server name> --name <firewal lrule name> --start-ip-address '<IP Address other than 0.0.0.0>' --end-ip-address '<IP Address other than 0.0.0.0 or 255.255.255.255>'

From PowerShell
Disable Default Firewall Rule Allow access to Azure services :

Remove-AzSqlServerFirewallRule -FirewallRuleName 'AllowAllWindowsAzureIps' -ResourceGroupName <resource group name> -ServerName <server name>

Remove a custom Firewall rule:

Remove-AzSqlServerFirewallRule -FirewallRuleName '<firewall rule name>' -ResourceGroupName <resource group name> -ServerName <server name>

Set the appropriate firewall rules:

Set-AzSqlServerFirewallRule -ResourceGroupName <resource group name> -ServerName <server name> -FirewallRuleName '<firewall rule name>' -StartIpAddress '<IP Address other than 0.0.0.0>' -EndIpAddress '<IP Address other than 0.0.0.0 or 255.255.255.255>'

Default Value:

By default, setting Allow access to Azure Services is set to ON allowing access to all Windows Azure IP ranges.

See Also

https://workbench.cisecurity.org/files/4052

Item Details

References: CSCv7|14.6

Plugin: microsoft_azure

Control ID: f8bee94d6019c8e632af6afe464b1e29f071aee4c992596413c112d67a82850b