Skip to content

Commit 5b5768f

Browse files
bwrenbwren
committed
Azure Monitor agent SHA-2 enforcement
1 parent db072c4 commit 5b5768f

File tree

2 files changed

+73
-60
lines changed

2 files changed

+73
-60
lines changed

‎articles/azure-monitor/platform/log-analytics-agent.md

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -124,8 +124,8 @@ The following table highlights the packages required for supported Linux distros
124124

125125
|Required package |Description |Minimum version |
126126
|-----------------|------------|----------------|
127-
|Glibc | GNU C Library | 2.5-12
128-
|Openssl | OpenSSL Libraries | 1.0.x or 1.1.x |
127+
|Glibc | GNU C Library | 2.5-12
128+
|Openssl | OpenSSL Libraries | 1.0.x or 1.1.x |
129129
|Curl | cURL web client | 7.15.5 |
130130
|Python-ctypes | |
131131
|PAM | Pluggable Authentication Modules | |
@@ -137,6 +137,18 @@ The following table highlights the packages required for supported Linux distros
137137

138138
To ensure the security of data in transit to Azure Monitor logs, we strongly encourage you to configure the agent to use at least Transport Layer Security (TLS) 1.2. Older versions of TLS/Secure Sockets Layer (SSL) have been found to be vulnerable and while they still currently work to allow backwards compatibility, they are **not recommended**. For additional information, review [Sending data securely using TLS 1.2](data-security.md#sending-data-securely-using-tls-12).
139139

140+
## SHA-2 Code Signing Support Requirement for Windows
141+
The Windows agent will begin to exclusively use SHA-2 signing on May 18, 2020. This change will impact customers using the Log Analytics agent on a legacy OS as part of any Azure service (Azure Monitor, Azure Automation, Azure Update Management, Azure Change Tracking, Azure Security Center, Azure Sentinel, Windows Defender ATP). The change does not require any customer action unless you are running the agent on a legacy OS version (Windows 7, Windows Server 2008 R2 and Windows Server 2008). Customers running on a legacy OS version are required to take the following actions on their machines before May 18, 2020 or their agents will stop sending data to their Log Analytics workspaces:
142+
143+
1. Install the latest Service Pack for your OS. The required service pack versions are:
144+
- Windows 7 SP1
145+
- Windows Server 2008 SP2
146+
- Windows Server 2008 R2 SP1
147+
148+
2. Install the SHA-2 signing Windows updates for your OS as described in [2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/2019-sha-2-code-signing-support-requirement-for-windows-and-wsus)
149+
3. Update to the latest version of the Windows agent (version 10.20.18029).
150+
4. Recommended to configure the agent to [use TLS 1.2](agent-windows.md#configure-agent-to-use-tls-12).
151+
140152

141153
## Network requirements
142154
The agent for Linux and Windows communicates outbound to the Azure Monitor service over TCP port 443, and if the machine connects through a firewall or proxy server to communicate over the Internet, review requirements below to understand the network configuration required. If your IT security policies do not allow computers on the network to connect to the Internet, you can set up a [Log Analytics gateway](gateway.md) and then configure the agent to connect through the gateway to Azure Monitor logs. The agent can then receive configuration information and send data collected depending on what data collection rules and monitoring solutions you have enabled in your workspace.
@@ -178,7 +190,7 @@ For example:
178190
`https://user01:[email protected]:30443`
179191

180192
> [!NOTE]
181-
> If you use special characters such as “\@” in your password, you receive a proxy connection error because value is parsed incorrectly. To work around this issue, encode the password in the URL using a tool such as [URLDecode](https://www.urldecoder.org/).
193+
> If you use special characters such as "\@" in your password, you receive a proxy connection error because value is parsed incorrectly. To work around this issue, encode the password in the URL using a tool such as [URLDecode](https://www.urldecoder.org/).
182194
183195

184196

‎articles/virtual-machines/extensions/oms-windows.md

Lines changed: 58 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ The following table provides a mapping of the version of the Windows Log Analyti
3232

3333
| Log Analytics Windows agent bundle version | Log Analytics Windows VM extension version | Release Date | Release Notes |
3434
|--------------------------------|--------------------------|--------------------------|--------------------------|
35+
| 10.20.18029 | 1.0.18029 | March 2020 | <ul><li>Adds SHA-2 code signing support</li><li>Improves VM extension installation and management</li><li>Resolves a bug in Azure Arc for Servers integration</li><li>Adds a built-in troubleshooting tool for customer support</li><li>Adds support for additional Azure Government regions</li> |
3536
| 10.20.18018 | 1.0.18018 | October 2019 | <ul><li> Minor bug fixes and stabilization improvements </li></ul> |
3637
| 10.20.18011 | 1.0.18011 | July 2019 | <ul><li> Minor bug fixes and stabilization improvements </li><li> Increased MaxExpressionDepth to 10000 </li></ul> |
3738
| 10.20.18001 | 1.0.18001 | June 2019 | <ul><li> Minor bug fixes and stabilization improvements </li><li> Added ability to disable default credentials when making proxy connection (support for WINHTTP_AUTOLOGON_SECURITY_LEVEL_HIGH) </li></ul>|
@@ -56,25 +57,25 @@ The following JSON shows the schema for the Log Analytics agent extension. The e
5657

5758
```json
5859
{
59-
"type": "extensions",
60-
"name": "OMSExtension",
61-
"apiVersion": "[variables('apiVersion')]",
62-
"location": "[resourceGroup().location]",
63-
"dependsOn": [
64-
"[concat('Microsoft.Compute/virtualMachines/', variables('vmName'))]"
65-
],
66-
"properties": {
67-
"publisher": "Microsoft.EnterpriseCloud.Monitoring",
68-
"type": "MicrosoftMonitoringAgent",
69-
"typeHandlerVersion": "1.0",
70-
"autoUpgradeMinorVersion": true,
71-
"settings": {
72-
"workspaceId": "myWorkSpaceId"
73-
},
74-
"protectedSettings": {
75-
"workspaceKey": "myWorkspaceKey"
76-
}
77-
}
60+
"type": "extensions",
61+
"name": "OMSExtension",
62+
"apiVersion": "[variables('apiVersion')]",
63+
"location": "[resourceGroup().location]",
64+
"dependsOn": [
65+
"[concat('Microsoft.Compute/virtualMachines/', variables('vmName'))]"
66+
],
67+
"properties": {
68+
"publisher": "Microsoft.EnterpriseCloud.Monitoring",
69+
"type": "MicrosoftMonitoringAgent",
70+
"typeHandlerVersion": "1.0",
71+
"autoUpgradeMinorVersion": true,
72+
"settings": {
73+
"workspaceId": "myWorkSpaceId"
74+
},
75+
"protectedSettings": {
76+
"workspaceKey": "myWorkspaceKey"
77+
}
78+
}
7879
}
7980
```
8081
### Property values
@@ -107,51 +108,51 @@ The following example assumes the Log Analytics extension is nested inside the v
107108

108109
```json
109110
{
110-
"type": "extensions",
111-
"name": "OMSExtension",
112-
"apiVersion": "[variables('apiVersion')]",
113-
"location": "[resourceGroup().location]",
114-
"dependsOn": [
115-
"[concat('Microsoft.Compute/virtualMachines/', variables('vmName'))]"
116-
],
117-
"properties": {
118-
"publisher": "Microsoft.EnterpriseCloud.Monitoring",
119-
"type": "MicrosoftMonitoringAgent",
120-
"typeHandlerVersion": "1.0",
121-
"autoUpgradeMinorVersion": true,
122-
"settings": {
123-
"workspaceId": "myWorkSpaceId"
124-
},
125-
"protectedSettings": {
126-
"workspaceKey": "myWorkspaceKey"
127-
}
128-
}
111+
"type": "extensions",
112+
"name": "OMSExtension",
113+
"apiVersion": "[variables('apiVersion')]",
114+
"location": "[resourceGroup().location]",
115+
"dependsOn": [
116+
"[concat('Microsoft.Compute/virtualMachines/', variables('vmName'))]"
117+
],
118+
"properties": {
119+
"publisher": "Microsoft.EnterpriseCloud.Monitoring",
120+
"type": "MicrosoftMonitoringAgent",
121+
"typeHandlerVersion": "1.0",
122+
"autoUpgradeMinorVersion": true,
123+
"settings": {
124+
"workspaceId": "myWorkSpaceId"
125+
},
126+
"protectedSettings": {
127+
"workspaceKey": "myWorkspaceKey"
128+
}
129+
}
129130
}
130131
```
131132

132133
When placing the extension JSON at the root of the template, the resource name includes a reference to the parent virtual machine, and the type reflects the nested configuration.
133134

134135
```json
135136
{
136-
"type": "Microsoft.Compute/virtualMachines/extensions",
137-
"name": "<parentVmResource>/OMSExtension",
138-
"apiVersion": "[variables('apiVersion')]",
139-
"location": "[resourceGroup().location]",
140-
"dependsOn": [
141-
"[concat('Microsoft.Compute/virtualMachines/', variables('vmName'))]"
142-
],
143-
"properties": {
144-
"publisher": "Microsoft.EnterpriseCloud.Monitoring",
145-
"type": "MicrosoftMonitoringAgent",
146-
"typeHandlerVersion": "1.0",
147-
"autoUpgradeMinorVersion": true,
148-
"settings": {
149-
"workspaceId": "myWorkSpaceId"
150-
},
151-
"protectedSettings": {
152-
"workspaceKey": "myWorkspaceKey"
153-
}
154-
}
137+
"type": "Microsoft.Compute/virtualMachines/extensions",
138+
"name": "<parentVmResource>/OMSExtension",
139+
"apiVersion": "[variables('apiVersion')]",
140+
"location": "[resourceGroup().location]",
141+
"dependsOn": [
142+
"[concat('Microsoft.Compute/virtualMachines/', variables('vmName'))]"
143+
],
144+
"properties": {
145+
"publisher": "Microsoft.EnterpriseCloud.Monitoring",
146+
"type": "MicrosoftMonitoringAgent",
147+
"typeHandlerVersion": "1.0",
148+
"autoUpgradeMinorVersion": true,
149+
"settings": {
150+
"workspaceId": "myWorkSpaceId"
151+
},
152+
"protectedSettings": {
153+
"workspaceKey": "myWorkspaceKey"
154+
}
155+
}
155156
}
156157
```
157158

0 commit comments

Comments
 (0)