Month: May 2021

Using Hub-Spoke Topology Benefits: Network Isolation Ready to grow – with growing the company, IT, computer systems. The central point of Administration Control traffic in HUB between different Spokes Control Traffic to/from the Internet Control Traffic to/from On-Premises Capture traffic on HUBs Easy to put NSG based on all networks like 172.21.0.0/20 Hubs Should be included Shared Services like DNS, Active Directory Granular separation of tasks between IT (SecOps, InfraOps) and workloads (Devops) – an eg. different team can have access to Spoke, different to HUB. Hubs reduce the potential for misconfiguration and exposure services to the Internet. More information: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/hub-spoke-network-topology  

Previously in part 1 and part 2, there was no final and easy-to-use solution to prevent bad guys to map your website. There is a final solution that works with On-Premise IIS and with Azure Web App. It is independent of Web Application Firewall and Front Door service.   The solution is based on rewrite, and based on information that we want to protect mapping for an example /a subdirectory and /b sbdirectory we should create the following config:   <?xml version=”1.0″ encoding=”UTF-8″?> <configuration> <appSettings> <add key=”setting1″ value=”setting1″ /> </appSettings> <system.webServer> <rewrite> <rules> <rule name=”RequestBlockingRulea” stopProcessing=”true”> <match url=”.*” /> <conditions> <add input=”{URL}” pattern=”^/a(/?|/.)$” /> </conditions> <action type=”CustomResponse” statusCode=”404″ statusReason=”Not Found” /> </rule> <rule name=”RequestBlockingRuleb” stopProcessing=”true”> <match url=”.*” /> <conditions> <add input=”{URL}” pattern=”^/b(/?|/.)$” /> </conditions> <action type=”CustomResponse” statusCode=”404″ statusReason=”Not Found” /> </rule> </rules> </rewrite> <httpErrors errorMode=”Custom” existingResponse=”Replace” > <remove statusCode=”500″/> <error statusCode=”500″ path=”hostingstart.html” responseMode=”File”/> <remove statusCode=”404″/> <error statusCode=”404″ path=”hostingstart.html” responseMode=”File”/> <remove statusCode=”400″/> <error statusCode=”400″ path=”hostingstart.html” responseMode=”File”/> <remove statusCode=”403″/> <error statusCode=”403″ path=”hostingstart.html” responseMode=”File”/> </httpErrors> </system.webServer> </configuration>   Rewrite rules return 404 Not Found for subdirectory /a and subdirectory /b and must be adjusted to your directories in your solution. Please be aware that access to /b/file.ext is not blocked. If you have … The security problem of the mapping file structure of Azure Web App and other IIS APP – part 3Read more

Previously I showed you the method of preventing mapping of the file structure of your WebApp based on 404 and 403 response codes. The disadvantage of runAllManagedModulesForAllRequests=”true” method is that it must be handled by application code. The main problem is that these requests 403 and 404 are server not by IIS from WebApp, but by Load Balancer… So, if we cannot do it in that way, let’s try to use a Web Application Firewall for that. In Azure, we can utilize for that Web Application Firewall and/or Front Door with WAF Policies. So, the concept is to create at least two custom rules: The first rule Prevent browsing Existing Directory – and it must include all existing directories of the application: This simply prevents enumerating all directories. The second rule will allow traffic only to the listed files and directories, but only if the previous does not meet conditions, so files in directories can be browsed. It can look like:   So it is not so easy, but we can use regex also for that.   Another method can be to allow only specific URI based on Regex as a first rule and then as a second rule Deny. … The security problem of the mapping file structure of Azure Web App and other IIS APP – part 2.Read more

New-AzRoleAssigment -objectid service_principal -RoleDefinitionName “Managed Identity Operator” -Scope ResourceID In case of error: Principals of type Application cannot validly be used in role assignments   Please provide -objectid Service Principal, not Application. Just display it, by: Get-AzureADServicePrincipal -SearchString “app_name”

If you deploy sample ASP.NET 4.x pure, out of the box web app (https://portal.azure.com/#create/Microsoft.WebSite) the behaviors is like: https://pure.azurewebsites.net/yfgrueygfuyrgfrf – 404 error – what is ok… https://pure.azurewebsites.net/a/a.txt – 200 OK (of course you need first put a.txt file to this directory) https://pure.azurewebsites.net/a/ – 403 forbidden – so it means that hacker can search for something here. Expected secure behavior is to return here 404 also…   I tried to test UMBRACO CMS deployed from Azure marketplace (https://portal.azure.com/#create/umbracoorg.UmbracoCMS) what seems to be written to avoid mapping file structure – just see: https://umbrecomf.azurewebsites.net/wruihfgweihgufr – 404 error https://umbrecomf.azurewebsites.net/a/a.txt – 200 – OK (of course you need first put a.txt file to this directory) https://umbrecomf.azurewebsites.net/a/ – Also 404…  – What is OK…. We need this behavior… This behavior is because the UMBRACO CMS is routing all requests into the Umbraco app (<modules runAllManagedModulesForAllRequests=”true”>)  – and when the CMS encounters a path that hasn’t been configured in their system, it returns a 404. So it is addressed programmatically. UMBRACO CMS web.config: <?xml version=”1.0″ encoding=”utf-8″?> <configuration> <!– Define the Web.config template, which is used when creating the initial Web.config, and then transforms from web.Template.[Debug|Release].config are applied. Documentation for Web.config at: https://our.umbraco.com/documentation/Reference/Config/webconfig/ –>   <configSections> <section name=”clientDependency” … Security problem of mapping file structure of Azure Web App and other IIS APP – part 1.Read more