> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Check for Unrestricted SMTP Access ### More Info: Ensure that no network security groups allow unrestricted inbound access on TCP port 25. ### Risk Level High ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * FedRAMP * GDPR * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Sure, here are the step by step instructions to remediate Unrestricted SMTP Access misconfiguration in Azure: 1. Login to the Azure portal and navigate to the problematic resource group. 2. In the left-hand menu, click on "Network security group". 3. Select the network security group that is associated with the affected resource. 4. Click on "Inbound security rules" and then click on "Add". 5. In the "Add inbound security rule" page, provide the following details: * Source: Select "IP addresses". * Source IP addresses: Enter the IP address range that you want to allow SMTP access for. * Destination: Select "Any". * Protocol: Select "TCP". * Destination port ranges: Enter "25" (SMTP port number). * Name: Enter a name for the rule. * Priority: Choose a priority number that is lower than the existing SMTP rule. 6. Click on "Add" to create the new rule. 7. Verify that the new rule is created successfully and the old rule is deleted. By following these steps, you have successfully remediated the Unrestricted SMTP Access misconfiguration in Azure using the Azure console. # To remediate Unrestricted SMTP Access in AZURE using AZURE CLI, you can follow the below steps: Step 1: Open the Azure CLI on your local machine. Step 2: Login to your Azure account using the below command: ``` az login ``` Step 3: Once you are logged in, run the below command to list all the virtual machines in your Azure account: ``` az vm list ``` Step 4: Identify the virtual machine that has unrestricted SMTP access. Step 5: Run the below command to open the Network Security Group (NSG) associated with the virtual machine: ``` az network nsg show --resource-group --name ``` Step 6: Identify the rule that allows unrestricted SMTP access. Step 7: Run the below command to delete the rule: ``` az network nsg rule delete --resource-group --nsg-name --name ``` Step 8: Verify that the rule has been deleted by running the below command: ``` az network nsg show --resource-group --name ``` Once you have followed the above steps, the Unrestricted SMTP Access misconfiguration in AZURE would have been remediated successfully. To remediate Unrestricted SMTP Access issue in Azure using Python, you can follow these steps: 1. Import the required libraries: ``` import os from azure.identity import DefaultAzureCredential from azure.mgmt.network import NetworkManagementClient ``` 2. Authenticate with Azure: ``` credential = DefaultAzureCredential() subscription_id = '' network_client = NetworkManagementClient(credential, subscription_id) ``` 3. Get the list of network security groups in your subscription: ``` nsg_list = network_client.network_security_groups.list_all() ``` 4. For each network security group, check if there is a rule allowing unrestricted SMTP access: ``` for nsg in nsg_list: for rule in nsg.security_rules: if rule.destination_port_range == '25' and rule.destination_address_prefix == '*': print(f"Unrestricted SMTP access is allowed in NSG {nsg.name}") ``` 5. If you find a rule allowing unrestricted SMTP access, remove it: ``` for nsg in nsg_list: for rule in nsg.security_rules: if rule.destination_port_range == '25' and rule.destination_address_prefix == '*': print(f"Removing rule {rule.name} from NSG {nsg.name}") network_client.security_rules.begin_delete(resource_group_name='', network_security_group_name=nsg.name, security_rule_name=rule.name).wait() ``` Note: Replace `` and `` with your actual subscription ID and resource group name. Also, make sure you have the necessary permissions to modify network security groups in your Azure subscription. ```hcl theme={null} resource "azurerm_network_security_group" "SMTP_SECURE_NSG" { name = "SMTP_SECURE_NSG" # replace with your NSG name location = "AZURE_REGION" # e.g. "eastus" resource_group_name = "RESOURCE_GROUP_NAME" # replace with your RG name # Example of a RESTRICTED inbound SMTP rule (replace existing 0.0.0.0/0 allow) security_rule { name = "allow-smtp-from-approved-sources" priority = 100 # must be unique within NSG direction = "Inbound" access = "Allow" protocol = "Tcp" source_port_range = "*" destination_port_range = "25" source_address_prefixes = ["APPROVED_CIDR_1", "APPROVED_CIDR_2"] # e.g. "203.0.113.0/24" destination_address_prefix = "*" } # If you had an existing UNRESTRICTED rule like below, REMOVE or EDIT it: # security_rule { # name = "allow-smtp-anywhere" # priority = 200 # direction = "Inbound" # access = "Allow" # protocol = "Tcp" # source_port_range = "*" # destination_port_range = "25" # source_address_prefix = "*" # destination_address_prefix = "*" # } } ``` If you are tightening an existing rule (changing `source_address_prefix` from `"*"` or `0.0.0.0/0` to specific CIDRs), Terraform will update that individual `security_rule`; the NSG itself is not replaced, but the rule object is modified, which may briefly impact SMTP reachability from disallowed sources. For verification, `terraform plan` should show either: * a modification of the existing SMTP rule changing `source_address_prefix`/`source_address_prefixes` from `"*"` (or `0.0.0.0/0`) to your specific CIDRs, or * a deletion of the unrestricted SMTP rule and creation of a new, restricted one, with no other unrelated changes.