Check for Unrestricted SMTP Access

Using Console

Sure, here are the step by step instructions to remediate Unrestricted SMTP Access misconfiguration in Azure:

Login to the Azure portal and navigate to the problematic resource group.
In the left-hand menu, click on “Network security group”.
Select the network security group that is associated with the affected resource.
Click on “Inbound security rules” and then click on “Add”.
In the “Add inbound security rule” page, provide the following details:
- Source: Select “IP addresses”.
- Source IP addresses: Enter the IP address range that you want to allow SMTP access for.
- Destination: Select “Any”.
- Protocol: Select “TCP”.
- Destination port ranges: Enter “25” (SMTP port number).
- Name: Enter a name for the rule.
- Priority: Choose a priority number that is lower than the existing SMTP rule.
Click on “Add” to create the new rule.
Verify that the new rule is created successfully and the old rule is deleted.

By following these steps, you have successfully remediated the Unrestricted SMTP Access misconfiguration in Azure using the Azure console.

Using CLI

To remediate Unrestricted SMTP Access in AZURE using AZURE CLI, you can follow the below steps:Step 1: Open the Azure CLI on your local machine.Step 2: Login to your Azure account using the below command:

az login

Step 3: Once you are logged in, run the below command to list all the virtual machines in your Azure account:

az vm list

Step 4: Identify the virtual machine that has unrestricted SMTP access.Step 5: Run the below command to open the Network Security Group (NSG) associated with the virtual machine:

az network nsg show --resource-group <resource-group-name> --name <nsg-name>

Step 6: Identify the rule that allows unrestricted SMTP access.Step 7: Run the below command to delete the rule:

az network nsg rule delete --resource-group <resource-group-name> --nsg-name <nsg-name> --name <rule-name>

Step 8: Verify that the rule has been deleted by running the below command:

az network nsg show --resource-group <resource-group-name> --name <nsg-name>

Once you have followed the above steps, the Unrestricted SMTP Access misconfiguration in AZURE would have been remediated successfully.

Using Python

To remediate Unrestricted SMTP Access issue in Azure using Python, you can follow these steps:

Import the required libraries:

import os
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

Authenticate with Azure:

credential = DefaultAzureCredential()
subscription_id = '<your-subscription-id>'
network_client = NetworkManagementClient(credential, subscription_id)

Get the list of network security groups in your subscription:

nsg_list = network_client.network_security_groups.list_all()

For each network security group, check if there is a rule allowing unrestricted SMTP access:

for nsg in nsg_list:
    for rule in nsg.security_rules:
        if rule.destination_port_range == '25' and rule.destination_address_prefix == '*':
            print(f"Unrestricted SMTP access is allowed in NSG {nsg.name}")

If you find a rule allowing unrestricted SMTP access, remove it:

for nsg in nsg_list:
    for rule in nsg.security_rules:
        if rule.destination_port_range == '25' and rule.destination_address_prefix == '*':
            print(f"Removing rule {rule.name} from NSG {nsg.name}")
            network_client.security_rules.begin_delete(resource_group_name='<your-resource-group>', network_security_group_name=nsg.name, security_rule_name=rule.name).wait()

Note: Replace <your-subscription-id> and <your-resource-group> with your actual subscription ID and resource group name. Also, make sure you have the necessary permissions to modify network security groups in your Azure subscription.

Using Terraform

resource "azurerm_network_security_group" "SMTP_SECURE_NSG" {
  name                = "SMTP_SECURE_NSG"           # replace with your NSG name
  location            = "AZURE_REGION"              # e.g. "eastus"
  resource_group_name = "RESOURCE_GROUP_NAME"       # replace with your RG name

  # Example of a RESTRICTED inbound SMTP rule (replace existing 0.0.0.0/0 allow)
  security_rule {
    name                       = "allow-smtp-from-approved-sources"
    priority                   = 100                  # must be unique within NSG
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "25"
    source_address_prefixes    = ["APPROVED_CIDR_1", "APPROVED_CIDR_2"] # e.g. "203.0.113.0/24"
    destination_address_prefix = "*"
  }

  # If you had an existing UNRESTRICTED rule like below, REMOVE or EDIT it:
  # security_rule {
  #   name                       = "allow-smtp-anywhere"
  #   priority                   = 200
  #   direction                  = "Inbound"
  #   access                     = "Allow"
  #   protocol                   = "Tcp"
  #   source_port_range          = "*"
  #   destination_port_range     = "25"
  #   source_address_prefix      = "*"
  #   destination_address_prefix = "*"
  # }
}

If you are tightening an existing rule (changing source_address_prefix from "*" or 0.0.0.0/0 to specific CIDRs), Terraform will update that individual security_rule; the NSG itself is not replaced, but the rule object is modified, which may briefly impact SMTP reachability from disallowed sources.For verification, terraform plan should show either:

a modification of the existing SMTP rule changing source_address_prefix/source_address_prefixes from "*" (or 0.0.0.0/0) to your specific CIDRs, or
a deletion of the unrestricted SMTP rule and creation of a new, restricted one, with no other unrelated changes.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Check for Unrestricted SMTP Access

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​