|
2 | 2 | title: Security overview |
3 | 3 | description: Security information about Azure Arc-enabled servers. |
4 | 4 | ms.topic: conceptual |
5 | | -ms.date: 08/30/2021 |
| 5 | +ms.date: 03/17/2022 |
6 | 6 | --- |
7 | 7 |
|
8 | 8 | # Azure Arc-enabled servers security overview |
@@ -38,6 +38,116 @@ The Azure Connected Machine agent is composed of three services, which run on yo |
38 | 38 |
|
39 | 39 | The guest configuration and extension services run as Local System on Windows, and as root on Linux. |
40 | 40 |
|
| 41 | +## Local agent security controls |
| 42 | + |
| 43 | +Starting with agent version 1.16, you can optionally limit the extensions that can be installed on your server and disable Guest Configuration. These controls can be useful when connecting servers to Azure that need to be monitored or secured by Azure, but should not allow arbitrary management capabilities like running scripts with Custom Script Extension or configuring settings on the server with Guest Configuration. |
| 44 | + |
| 45 | +These security controls can only be configured by running a command on the server itself and cannot be modified from Azure. This approach preserves the server admin's intent when enabling remote management scenarios with Azure Arc, but also means that changing the setting is more difficult if you later decide to change them. This feature is intended for particularly sensitive servers (for example, Active Directory Domain Controllers, servers that handle payment data, and servers subject to strict change control measures). In most other cases, it is not necessary to modify these settings. |
| 46 | + |
| 47 | +### Extension allowlists and blocklists |
| 48 | + |
| 49 | +To limit which [extensions](manage-vm-extensions.md) can be installed on your server, you can configure lists of the extensions you wish to allow and block on the server. The extension manager will evaluate all requests to install, update, or upgrade extensions against the allowlist and blocklist to determine if the extension can be installed on the server. Delete requests are always allowed. |
| 50 | + |
| 51 | +The most secure option is to explicitly allow the extensions you expect to be installed. Any extension not in the allowlist is automatically blocked. To configure the Azure Connected Machine agent to allow only the Log Analytics Agent for Linux and the Dependency Agent for Linux, run the following command on each server: |
| 52 | + |
| 53 | +```bash |
| 54 | +azcmagent config set extensions.allowlist "Microsoft.EnterpriseCloud.Monitoring/OMSAgentForLinux,Microsoft.Azure.Monitoring.DependencyAgent/DependencyAgentLinux" |
| 55 | +``` |
| 56 | + |
| 57 | +You can block one or more extensions by adding them to the blocklist. If an extension is present in both the allowlist and blocklist, it will be blocked. To block the Custom Script extension for Linux, run the following command: |
| 58 | + |
| 59 | +```bash |
| 60 | +azcmagent config set extensions.blocklist "Microsoft.Azure.Extensions/CustomScript" |
| 61 | +``` |
| 62 | + |
| 63 | +Extensions are specified by their publisher and type, separated by a forward slash. See the list of the [most common extensions](manage-vm-extensions.md) in the docs or list the VM extensions already installed on your server in the [portal](manage-vm-extensions-portal.md#list-extensions-installed), [Azure PowerShell](manage-vm-extensions-powershell.md#list-extensions-installed), or [Azure CLI](manage-vm-extensions-cli.md#list-extensions-installed). |
| 64 | + |
| 65 | +The table below describes the behavior when performing an extension operation against an agent that has the allowlist or blocklist configured. |
| 66 | + |
| 67 | +| Operation | In the allowlist | In the blocklist | In both the allowlist and blocklist | Not in any list, but an allowlist is configured | |
| 68 | +|--|--|--|--| |
| 69 | +| Install extension | Allowed | Blocked | Blocked | Blocked | |
| 70 | +| Update (reconfigure) extension | Allowed | Blocked | Blocked | Blocked | |
| 71 | +| Upgrade extension | Allowed | Blocked | Blocked | Blocked | |
| 72 | +| Delete extension | Allowed | Allowed | Allowed | Allowed | |
| 73 | + |
| 74 | +> [!IMPORTANT] |
| 75 | +> If an extension is already installed on your server before you configure an allowlist or blocklist, it will not automatically be removed. It is your responsibility to delete the extension from Azure to fully remove it from the machine. Delete requests are always accepted to accommodate this scenario. Once deleted, the allowlist and blocklist will determine whether or not to allow future install attempts. |
| 76 | +
|
| 77 | +### Enable or disable Guest Configuration |
| 78 | + |
| 79 | +Azure Policy's Guest Configuration feature enables you to audit and configure settings on your server from Azure. You can disable Guest Configuration from running on your server if you don't want to allow this functionality by running the following command: |
| 80 | + |
| 81 | +```bash |
| 82 | +azcmagent config set guestconfiguration.enabled false |
| 83 | +``` |
| 84 | + |
| 85 | +When Guest Configuration is disabled, any Guest Configuration policies assigned to the machine in Azure will report as non-compliant. Consider [creating an exemption](../../governance/policy/concepts/exemption-structure.md) for these machines or [changing the scope](../../governance/policy/concepts/assignment-structure.md#excluded-scopes) of your policy assignments if you don't want to see these machines reported as non-compliant. |
| 86 | + |
| 87 | +### Locked down machine best practices |
| 88 | + |
| 89 | +When configuring the Azure Connected Machine agent with a reduced set of capabilities, it is important to consider the mechanisms that someone could use to remove those restrictions and implement appropriate controls. Anybody capable of running commands as an administrator or root user on the server can change the Azure Connected Machine agent configuration. Extensions and guest configuration policies execute in privileged contexts on your server, and as such may be able to change the agent configuration. If you apply these security controls to lock down the agent, Microsoft recommends the following best practices to ensure only local server admins can update the agent configuration: |
| 90 | + |
| 91 | +* Use allowlists for extensions instead of blocklists whenever possible. |
| 92 | +* Don't include the Custom Script Extension in the extension allowlist to prevent execution of arbitrary scripts that could change the agent configuration. |
| 93 | +* Disable Guest Configuration to prevent the use of custom Guest Configuration policies that could change the agent configuration. |
| 94 | + |
| 95 | +### Example configuration for monitoring and security scenarios |
| 96 | + |
| 97 | +It's common to use Azure Arc to monitor your servers with Azure Monitor and Microsoft Sentinel and secure them with Microsoft Defender for Cloud. The following configuration samples can help you configure the Azure Arc agent to only allow these scenarios. |
| 98 | + |
| 99 | +#### Azure Monitor Agent only |
| 100 | + |
| 101 | +On your Windows servers, run the following commands in an elevated command console: |
| 102 | + |
| 103 | +```powershell |
| 104 | +azcmagent config set extensions.allowlist "Microsoft.Azure.Monitor/AzureMonitorWindowsAgent" |
| 105 | +azcmagent config set guestconfiguration.enabled false |
| 106 | +``` |
| 107 | + |
| 108 | +On your Linux servers, run the following commands: |
| 109 | + |
| 110 | +```bash |
| 111 | +sudo azcmagent config set extensions.allowlist "Microsoft.Azure.Monitor/AzureMonitorLinuxAgent" |
| 112 | +sudo azcmagent config set guestconfiguration.enabled false |
| 113 | +``` |
| 114 | + |
| 115 | +#### Log Analytics and dependency (Azure Monitor VM Insights) only |
| 116 | + |
| 117 | +This configuration is for the legacy Log Analytics agents and the dependency agent. |
| 118 | + |
| 119 | +On your Windows servers, run the following commands in an elevated console: |
| 120 | + |
| 121 | +```powershell |
| 122 | +azcmagent config set extensions.allowlist "Microsoft.EnterpriseCloud.Monitoring/MicrosoftMonitoringAgent,Microsoft.Azure.Monitoring.DependencyAgent/DependencyAgentWindows" |
| 123 | +azcmagent config set guestconfiguration.enabled false |
| 124 | +``` |
| 125 | + |
| 126 | +On your Linux servers, run the following commands: |
| 127 | + |
| 128 | +```bash |
| 129 | +sudo azcmagent config set extensions.allowlist "Microsoft.EnterpriseCloud.Monitoring/OMSAgentForLinux,Microsoft.Azure.Monitoring.DependencyAgent/DependencyAgentLinux" |
| 130 | +sudo azcmagent config set guestconfiguration.enabled false |
| 131 | +``` |
| 132 | + |
| 133 | +#### Monitoring and security |
| 134 | + |
| 135 | +Microsoft Defender for Cloud enables additional extensions on your server to identify vulnerable software on your server and enable Microsoft Defender for Endpoint (if configured). Microsoft Defender for Cloud also uses Guest Configuration for its regulatory compliance feature. Since a custom Guest Configuration assignment could be used to undo the agent limitations, you should carefully evaluate whether or not you need the regulatory compliance feature and, as a result, Guest Configuration to be enabled on the machine. |
| 136 | + |
| 137 | +On your Windows servers, run the following commands in an elevated command console: |
| 138 | + |
| 139 | +```powershell |
| 140 | +azcmagent config set extensions.allowlist "Microsoft.EnterpriseCloud.Monitoring/MicrosoftMonitoringAgent,Qualys/WindowsAgent.AzureSecurityCenter,Microsoft.Azure.AzureDefenderForServers/MDE.Windows,Microsoft.Azure.AzureDefenderForSQL/AdvancedThreatProtection.Windows" |
| 141 | +azcmagent config set guestconfiguration.enabled true |
| 142 | +``` |
| 143 | + |
| 144 | +On your Linux servers, run the following commands: |
| 145 | + |
| 146 | +```bash |
| 147 | +sudo azcmagent config set extensions.allowlist "Microsoft.EnterpriseCloud.Monitoring/OMSAgentForLinux,Qualys/LinuxAgent.AzureSecurityCenter,Microsoft.Azure.AzureDefenderForServers/MDE.Linux" |
| 148 | +sudo azcmagent config set guestconfiguration.enabled true |
| 149 | +``` |
| 150 | + |
41 | 151 | ## Using a managed identity with Azure Arc-enabled servers |
42 | 152 |
|
43 | 153 | By default, the Azure Active Directory system assigned identity used by Arc can only be used to update the status of the Azure Arc-enabled server in Azure. For example, the *last seen* heartbeat status. You can optionally assign other roles to the identity if an application on your server uses the system assigned identity to access other Azure services. To learn more about configuring a system-assigned managed identity to access Azure resources, see [Authenticate against Azure resources with Azure Arc-enabled servers](managed-identity-authentication.md). |
|
0 commit comments