Unrestricted DNS Access

More Info:

Ensure that no network security groups allow unrestricted inbound access on TCP and UDP port 53

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• FedRAMP
• GDPR
• HIPAA
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the unrestricted DNS access issue in Azure, please follow the below steps:

Step 1: Login to the Azure portal (https://portal.azure.com/) using your credentials.

Step 2: In the left-hand side menu, click on the “Networking” option.

Step 3: Under the “Networking” menu, click on the “DNS zones” option.

Step 4: Select the DNS zone that you want to restrict access to.

Step 5: Under the “Settings” menu, click on the “Access control (IAM)” option.

Step 6: Click on the “Add” button to add a new role assignment.

Step 7: In the “Add role assignment” window, select the “Contributor” role from the “Role” dropdown menu.

Step 8: In the “Assign access to” section, select “User, group, or service principal” from the dropdown menu.

Step 9: In the “Select” field, enter the name of the user, group, or service principal that you want to restrict access to.

Step 10: Click on the “Save” button to save the changes.

By following the above steps, you can restrict access to the DNS zone and remediate the unrestricted DNS access issue in Azure.

Using CLI

To remediate Unrestricted DNS Access in AZURE using AZURE CLI, follow these steps:

1. Open the AZURE CLI and login to your AZURE account.
2. Run the following command to list all the virtual networks in your subscription:
   az network vnet list
   
3. Identify the virtual network that has unrestricted DNS access.
4. Run the following command to update the virtual network and restrict DNS access:
   az network vnet update --name <virtual_network_name> --resource-group <resource_group_name> --dns-servers ""
   
   Replace <virtual_network_name> with the name of the virtual network that has unrestricted DNS access and <resource_group_name> with the name of the resource group that contains the virtual network.
5. After running the command, verify that the DNS servers are restricted by running the following command:
   az network vnet show --name <virtual_network_name> --resource-group <resource_group_name> --query 'dnsServers'
   
   This command should return an empty array, which means that DNS access is restricted.

By following these steps, you can remediate Unrestricted DNS Access in AZURE using AZURE CLI.

Using Python

To remediate unrestricted DNS access in Azure using Python, you can use the Azure SDK for Python. Here are the steps:

1. Install the Azure SDK for Python using pip:

pip install azure-mgmt-dns

2. Import the necessary modules:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.dns import DnsManagementClient

3. Authenticate using Service Principal credentials:

credentials = ServicePrincipalCredentials(
    client_id='<client-id>',
    secret='<client-secret>',
    tenant='<tenant-id>'
)

Replace the <client-id>, <client-secret>, and <tenant-id> with your own values.

4. Create a DNS management client:

dns_client = DnsManagementClient(credentials, '<subscription-id>')

Replace <subscription-id> with your own subscription ID.

5. Get the DNS zone that needs to be remediated:

zone_name = '<zone-name>'
resource_group_name = '<resource-group-name>'
zone = dns_client.zones.get(resource_group_name, zone_name)

Replace <zone-name> and <resource-group-name> with your own values.

6. Remove any records that allow unrestricted access:

for record in zone.records:
    if record.a_records:
        for a_record in record.a_records:
            if a_record.ipv4_address == '0.0.0.0':
                zone.records.remove(record)
    if record.aaaa_records:
        for aaaa_record in record.aaaa_records:
            if aaaa_record.ipv6_address == '::':
                zone.records.remove(record)

This code loops through all the records in the zone and removes any A or AAAA records that allow unrestricted access.

7. Update the DNS zone:

dns_client.zones.create_or_update(resource_group_name, zone_name, zone)

This code updates the DNS zone with the changes made in step 6.

That’s it! This code should remediate unrestricted DNS access in Azure using Python.

Using Terraform

# Existing Network Security Group
resource "azurerm_network_security_group" "dns_nsg" {
  name                = "DNS-NSG"
  location            = azurerm_resource_group.RG.location
  resource_group_name = azurerm_resource_group.RG.name
}

# Replace any existing "allow DNS from any" rule that has:
#   direction = "Inbound"
#   access    = "Allow"
#   protocol  = "Tcp" or "Udp" or "*"
#   destination_port_range = "53"
#   source_address_prefix = "*"
# with one or more tightly scoped rules like this:

resource "azurerm_network_security_rule" "allow_dns_tcp_restricted" {
  name                        = "allow-dns-tcp-restricted"
  priority                    = 200
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "53"

  # Replace with the specific CIDR(s) that are allowed to query DNS
  source_address_prefixes     = [
    "ALLOWED_DNS_CLIENT_CIDR_1", # e.g. "10.0.0.0/16"
    "ALLOWED_DNS_CLIENT_CIDR_2", # optional additional CIDR
  ]

  destination_address_prefix  = "*"

  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.dns_nsg.name
}

resource "azurerm_network_security_rule" "allow_dns_udp_restricted" {
  name                        = "allow-dns-udp-restricted"
  priority                    = 210
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Udp"
  source_port_range           = "*"
  destination_port_range      = "53"

  # Replace with the specific CIDR(s) that are allowed to query DNS
  source_address_prefixes     = [
    "ALLOWED_DNS_CLIENT_CIDR_1", # e.g. "10.0.0.0/16"
    "ALLOWED_DNS_CLIENT_CIDR_2",
  ]

  destination_address_prefix  = "*"

  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.dns_nsg.name
}

# OPTIONAL: If you do not want ANY inbound DNS from the public Internet at all,
# you can add explicit deny rules instead of (or in addition to) the allows above.
# Make sure their priorities are higher (lower numeric value) than any existing allows.

resource "azurerm_network_security_rule" "deny_dns_from_internet_tcp" {
  name                        = "deny-dns-tcp-from-internet"
  priority                    = 100
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "53"
  source_address_prefix       = "Internet"
  destination_address_prefix  = "*"

  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.dns_nsg.name
}

resource "azurerm_network_security_rule" "deny_dns_from_internet_udp" {
  name                        = "deny-dns-udp-from-internet"
  priority                    = 110
  direction                   = "Inbound"
  access                      = "Deny"
  protocol                    = "Udp"
  source_port_range           = "*"
  destination_port_range      = "53"
  source_address_prefix       = "Internet"
  destination_address_prefix  = "*"

  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.dns_nsg.name
}

Changing security rules is in-place and does not replace the azurerm_network_security_group, but it can immediately impact DNS reachability for affected clients once applied.

Verification: terraform plan should show removal or modification of any existing inbound Allow rules on TCP/UDP port 53 that have source_address_prefix = "*" / "0.0.0.0/0" or similar, and the creation of the restricted or deny rules above with the desired CIDR ranges.