Azure ‘Just in time’ VM access

When I first saw “’Just in time…(JIT)” as a new preview announcement for Azure VMs, my mind was cast back to one of my first roles in IT, working for an automotive firm who supplied parts for car manufacturers. JIT was (or is!) a supply chain strategy whereby the parts or products arrive at a specific point only when required. Although I wasn’t directly involved, it used to fill me with dread as some of the penalties for holding up the supply chain were eye watering Smile with tongue out Anyway, I digress…

In relation to the Azure announcement, JIT is a security process currently in preview in Azure, whereby access is granted to a virtual machine only when required. It is simple in it’s architecture, in that it uses ACLs/NSGs to lock down access to specific inbound ports until a request by an authorised user is made. This drastically reduces the attack surface of your virtual and reduces any potential attacks through basic port scanning and brute force.

Licensing wise, JIT is part of the standard tier of Azure Security. Azure Security Center comes in two tiers:

  1. Free tier – this is enabled by default on your subscription and provides access to key security recommendations to help protect your infrastructure
  2. Standard Tier – extends the cloud and on-premises capabilities of Azure Security Center. Additional features are noted below:
    • Hybrid Security
    • Advanced Threat Detection
    • JIT VM access
    • Adaptive application controls

The following link provides pricing details: https://docs.microsoft.com/en-us/azure/security-center/security-center-pricing (Note: the standard tier is free for the first 60 days to allow you to evaluate the components!)

Over the next few weeks I’ll aim to create blog posts for each of these areas to provide a rounded picture of what the standard security tier can provide for your organisation.

The preview of JIT can be found within the Azure Security Center pane, on the home page as seen in the below screenshot. As it is a preview you need to activate it:

image

An overview of some of the alert types and an activation link can be found on the next page:

image

If you click through the following page you will receive information around pricing and have the ability to “on-board” into the standard tier:

image

Once you click through, you need to apply the plan to your resources, select upgrade and then save the applicable settings:

image

If you navigate back to Security Center homepage – you will now see all of the new features activated within your subscription:

image

Enabling JIT is very simple. Click within the JIT context in the screenshot above, and you’ll be presented with the JIT pane. From within here, click the “Recommended” option, and you should see any VMs you have in your subscription not currently enabled for JIT:

image

From here simply click on the VM on the left hand side, review the current state/severity and then click “Enable JIT on x VMs”… A pane will appear recommending key ports that should be locked down. It is important to note from here you can add any additional ports, and also specific key things like source IPs that will be allowed access upon request, and the duration for which access will be granted.

image

image

Following this your VM will now go into a “resolved state” and you will be able to head back to the main JIT screen, navigate to the “configured” tab, and hit request access…

image

The request access screen will allow you to permit access to specific ports from either “MyIP” (which will detect the current IP you are accessing from) or a specific IP range. You can also specific a time frame, up to the maximum limit configured in an earlier step.

Note: the ability to request access will depend upon your user role and any configured RBAC settings in the Resource Group or Virtual Machine.

image

In summary? I think JIT is a great feature and another measure of the investment Microsoft are making in security on the Azure platform. It is a feature I will be talking about with clients and in conjunction with the other features of Security Center I think it is an investment many organisations will look to make.

Advertisements

Visibility and increasing your Azure Subscription limits and quotas

Azure contains a number of default subscription limits that should be considered as part of any Azure design phase. Majority of these limits are soft and you can raise a support case to have them raised. To avoid delays to any project I always recommend this is one of the first areas of consultation as there can be a lag between the request and it being actioned. The limitations are there for a number of reasons, primarily to help Microsoft control and capacity plan the environment whilst also ensuring usage is limited to protect the platform.

There is a very handy  view in the Azure Portal from which you can view by going to the new, preview “Cost Management + Billing” blade. From here go to “Subscriptions” and click the subscription you would like to view. From here you get some great statistics, e.g. spending rate, credit remaining, forecast, etc. all of which holds great value to assist you in planning and controlling your cost. If you navigate to “Usage and quotas” under the “Settings” menu you will see the following view:

image

There are other ways to view your usage quotas via PowerShell, however these are individual commands per resource. It wouldn’t take much to create a quick script that you can run regularly to expose this however the above view deals with it nicely I think. One of the example commands include “Get-AzureRmVmUsage –location <location>”

image

The bottom part of the page shows your current usage against your limits. It is now also very easy to “Request an Increase” – if you click this link you will be taken through a guided wizard to increase your limits.

image

Bear in mind this is resource and type specific, e.g. you will be asked to demonstrate the model you are using (Classic/ARM) , the impact on your business so they can set a priority, the location you need a request in and also the SKU family.

image

The final screen asks you to supply contact details and who should be notified throughout the ticket.

image

.. and there you go! – limits raised. Evidently this can take some time and it asks you to be pretty specific about what you are requesting therefore I highly recommend you take time to plan your deployments correctly to avoid any frustration.

Azure Portal–Ability to Quick Delete Resources

Very minor, and very finicky but one thing that’s always frustrated me in the Azure Portal is the inability to clear up my test subscriptions without having to resort to PowerShell. Occasionally I’ll spend some time spinning new services up directly in the portal rather than using PowerShell and when I’ve finished I like to clear things down to avoid costs which usually involves just deleting any resource groups I’ve spun up.

Now, the PowerShell to do this is pretty straight forward… can just use Get-AzureRmResourceGroup and Remove-AzureRmResourceGroup with a –force flag and a for-loop if you don’t want to iterate through, so why complain? Smile well sometimes launching a script or PowerShell is just too much which invariably means I’ll leave stuff running and then incur costs.

I’m not sure when this feature change came about (either last week during Ignite, or sooner, or has it been there all along and I’ve missed it?!) – however you can now do a select on all your resources (rather than individually), enter the word delete and then it’ll attempt to remove. This doesn’t always work as sometimes you’ll have nested resources that will block the deletion, however it’s a quick way to delete resources if you don’t want to resort to PowerShell.

image

Azure Network Announcements at Ignite 2017

My blog has been very quiet recently having taken a few weeks off to spend time with the family, before joining Insight UK as a Cloud Architect in the Hybrid Cloud Team. The new role is exciting and with all of the innovations in the cloud space across all vendors, it’s a great time to join Insight to help them with their quest to advise and help clients and the community in leveraging this.  However, enough of the excuses about why things have been quiet… Smile 

Image result for no excuses

Ignite 2017 is like Christmas for anyone with interest in the Microsoft ecosystem and there have been a ton of announcements from a technical, strategy and business perspective to keep us all busy for some time to come. I’ve been collating my thoughts and plan on pulling together an all up view of the event once it wraps up.

One of the key things to peak my interest (being heavily focused on Azure) is the announcements today in the networking space. The following Microsoft Azure Blog post by Yousef Khalidi, CVP of Azure Networking provides a great overview:

https://azure.microsoft.com/en-gb/blog/azure-networking-announcements-for-ignite-2017/

At first glance on the above blog I expected a small number of changes/innovations however there is 22 (with my very rough counting!) individual areas in the announcements. From general performance, better availability through to enhancements in monitoring and management. Some of the key areas that interested me include:

  • Virtual Network Service Endpoints – this is a very positive change. A number of customers questioned the need to publically address Azure services citing obvious security concerns and how this would be managed. There key question was always “how do I turn this off?” From an architecture perspective I guess the key challenge for MS was on-going management, how it would be accessed, etc. This new innovation removes the requirements for the public endpoint instead allowing you (if you want to!) restrict access to the service from your own VNet, not the internet. Awesome! As per the original MS blog, more info can be found here: https://docs.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview
  • ExpressRoute peering changes – this interested me as one of the key topics I usually discuss with clients is the 3 different peering options avaialble over ExpressRoute; private, public and Microsoft. As the blog notes, private includes traffic to your own VNets, public is traffic to Azure VIPs and Microsoft is traffic to SaaS services, e.g. 365. Customers have had several challenges with the MS peering namely around routing configurations within their own network and with the ExpressRoute provider. More recently, it was my understanding that Microsoft Peering was actually not recommended unless specific compliance regulations demanded this. With the above announcements it will be interesting to dig into this in more detail to understand it better. One for the ExpressRoute black belt calls.. Smile
  • General monitoring improvements – it’s great to see that OMS is mentioned everywhere and is becoming a key focal point across lots of components in the MS space. There are some great improvements that will help customers in this announcement, e.g. availability of your connections, monitoring endpoints (e.g. PaaS or SaaS availability) and some cool innovations around real user measurements and traffic flow within Traffic Manager.

Each of the above topics deserves individual consideration, as evidently a lot of effort has gone in behind the scenes by the Azure team, and it’s great to see them listen to customers and act on recommendations made. Big thumbs up and look forward to trying some of these out!

A quick look at Instant File Restore in an Azure VM…

Instant File Restore directly from an Azure VM is a feature release that caught my eye recently. I remember being excited in the early days with on-premises virtualisation when backup companies, e.g. Veeam introduced the ability to mount VM backups and access the file system directly, thus allowing a quick restore and always thought it was a handy feature. Granted, it does not (always) replace proper In-VM backups of the application or service however it does provide a quick and easy way to restore a file/config, etc.

The feature went GA a couple of days ago, however the portal still has it as in-preview. More info can be found on the Azure Blog Post:

https://azure.microsoft.com/en-us/blog/instant-file-recovery-from-azure-vm-backups-is-now-generally-available/

To start with you need an Azure Virtual Machine and some files you’d like to protect. I’ve created a simple VM from the marketplace running 2016 Datacentre. I created some test files on one of the disks:

1

You’ll then need to log into the Azure Portal, and you’ll need to have a Recovery Vault already configured with the virtual machine you want to protect added. The following screenshot shows the virtual machine ‘azurebackuptest’ added to the Recovery Vault:

1

If you do not have your machine added, then use the ‘Add’ button, and choose a backup policy. You now need to ensure you have a ‘restore point’ from which you can recover.

I’m now going to go back to my virtual machine and ‘permanently delete’ some files (so they’re gone from the recycle bin, too), as  you can see from the following screenshot:

2

We now have a virtual machine with missing files that’d we’d ordinarily need to recover from an In-VM backup agent – however we’ll use the File Recovery tools. Navigate to the vault again and choose ‘File Recovery (preview)’:

4

From here you need to select your recovery point, and download the executable.. it can take a minute or two to generate. Once you’ve downloaded the .exe, ‘unmount disks’ will flag up:

6

Now simply run the .exe file on the  machine where you’d like the disks to be mounted so you can copy them off. The exe will launch PowerShell and mount the disks as iSCSI targets (disconnecting any previous connections if you have any):

7

You can now browse the mounted disk and recover the files that were deleted earlier:

8

Once complete, remember to kill the PowerShell session as indicated in the previous screenshot, and don’t forget to click ‘unmount’ disks from the Azure Console:

9

That’s it! A straight forward feature but one that can be very handy occasionally and starts to bring even more parity between Azure and equivalent on-premises capabilities.