Skip to content

Commit 0c3731e

Browse files
BernieWhiteBernieWhite
authored
Add Entra Domain Service rules Azure#2837 (Azure#2838)
1 parent 3e416c5 commit 0c3731e

11 files changed

+607
-1
lines changed

‎.vscode/settings.json

+1
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@
9595
"NOTEQUALS",
9696
"NOTIN",
9797
"NSGs",
98+
"NTLM",
9899
"OWASP",
99100
"Peerings",
100101
"POLICYDEFINITIONID",

‎docs/CHANGELOG-v1.md

+8
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,14 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers
3535

3636
What's changed since pre-release v1.36.0-B0046:
3737

38+
- New rules:
39+
- Entra Domain Services:
40+
- Check that instances use a minimum version of NTLM by @BernieWhite.
41+
[#2837](https://github.com/Azure/PSRule.Rules.Azure/issues/2837)
42+
- Check that instances use a minimum version of TLS by @BernieWhite.
43+
[#2837](https://github.com/Azure/PSRule.Rules.Azure/issues/2837)
44+
- Check that instances do not use RC4 encryption by @BernieWhite.
45+
[#2837](https://github.com/Azure/PSRule.Rules.Azure/issues/2837)
3846
- General improvements:
3947
- **Important change**: Deprecated rules with no clear WAF alignment by @BernieWhite.
4048
[#2493](https://github.com/Azure/PSRule.Rules.Azure/issues/2493)

‎docs/en/rules/Azure.EntraDS.NTLM.md

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
reviewed: 2024-04-27
3+
severity: Critical
4+
pillar: Security
5+
category: SE:07 Encryption
6+
resource: Entra Domain Services
7+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.EntraDS.NTLM/
8+
---
9+
10+
# Disable NTLM v1
11+
12+
## SYNOPSIS
13+
14+
Disable NTLM v1 for Microsoft Entra Domain Services.
15+
16+
## DESCRIPTION
17+
18+
By default, Microsoft Entra Domain Services enables the use of ciphers and protocols such as NTLM v1.
19+
These ciphers may be required for some legacy applications, but are considered weak and can be disabled if not required.
20+
21+
## RECOMMENDATION
22+
23+
Consider disabling NTLM v1 which is considered weak and can be disabled if not required.
24+
25+
## EXAMPLES
26+
27+
### Configure with Azure template
28+
29+
To deploy domains that pass this rule:
30+
31+
- Set the `properties.domainSecuritySettings.ntlmV1` property to `Disabled`.
32+
33+
For example:
34+
35+
```json
36+
{
37+
"type": "Microsoft.AAD/domainServices",
38+
"apiVersion": "2022-12-01",
39+
"name": "[parameters('name')]",
40+
"location": "[parameters('location')]",
41+
"properties": {
42+
"ldapsSettings": {
43+
"ldaps": "Enabled"
44+
},
45+
"domainSecuritySettings": {
46+
"ntlmV1": "Disabled",
47+
"tlsV1": "Disabled",
48+
"kerberosRc4Encryption": "Disabled"
49+
}
50+
}
51+
}
52+
```
53+
54+
### Configure with Bicep
55+
56+
To deploy domains that pass this rule:
57+
58+
- Set the `properties.domainSecuritySettings.ntlmV1` property to `Disabled`.
59+
60+
For example:
61+
62+
```bicep
63+
resource ds 'Microsoft.AAD/domainServices@2022-12-01' = {
64+
name: name
65+
location: location
66+
properties: {
67+
ldapsSettings: {
68+
ldaps: 'Enabled'
69+
}
70+
domainSecuritySettings: {
71+
ntlmV1: 'Disabled'
72+
tlsV1: 'Disabled'
73+
kerberosRc4Encryption: 'Disabled'
74+
}
75+
}
76+
}
77+
```
78+
79+
## LINKS
80+
81+
- [SE:07 Encryption](https://learn.microsoft.com/azure/well-architected/security/encryption)
82+
- [Harden a Microsoft Entra Domain Services managed domain](https://learn.microsoft.com/entra/identity/domain-services/secure-your-domain)
83+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.aad/domainservices)

‎docs/en/rules/Azure.EntraDS.RC4.md

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
reviewed: 2024-04-27
3+
severity: Critical
4+
pillar: Security
5+
category: SE:07 Encryption
6+
resource: Entra Domain Services
7+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.EntraDS.RC4/
8+
---
9+
10+
# Disable RC4 encryption
11+
12+
## SYNOPSIS
13+
14+
Disable RC4 encryption for Microsoft Entra Domain Services.
15+
16+
## DESCRIPTION
17+
18+
By default, Microsoft Entra Domain Services enables the use of ciphers and protocols such as RC4.
19+
These ciphers may be required for some legacy applications, but are considered weak and can be disabled if not required.
20+
21+
## RECOMMENDATION
22+
23+
Consider disabling RC4 encryption which is considered weak and can be disabled if not required.
24+
25+
## EXAMPLES
26+
27+
### Configure with Azure template
28+
29+
To deploy domains that pass this rule:
30+
31+
- Set the `properties.domainSecuritySettings.kerberosRc4Encryption` property to `Disabled`.
32+
33+
For example:
34+
35+
```json
36+
{
37+
"type": "Microsoft.AAD/domainServices",
38+
"apiVersion": "2022-12-01",
39+
"name": "[parameters('name')]",
40+
"location": "[parameters('location')]",
41+
"properties": {
42+
"ldapsSettings": {
43+
"ldaps": "Enabled"
44+
},
45+
"domainSecuritySettings": {
46+
"ntlmV1": "Disabled",
47+
"tlsV1": "Disabled",
48+
"kerberosRc4Encryption": "Disabled"
49+
}
50+
}
51+
}
52+
```
53+
54+
### Configure with Bicep
55+
56+
To deploy domains that pass this rule:
57+
58+
- Set the `properties.domainSecuritySettings.kerberosRc4Encryption` property to `Disabled`.
59+
60+
For example:
61+
62+
```bicep
63+
resource ds 'Microsoft.AAD/domainServices@2022-12-01' = {
64+
name: name
65+
location: location
66+
properties: {
67+
ldapsSettings: {
68+
ldaps: 'Enabled'
69+
}
70+
domainSecuritySettings: {
71+
ntlmV1: 'Disabled'
72+
tlsV1: 'Disabled'
73+
kerberosRc4Encryption: 'Disabled'
74+
}
75+
}
76+
}
77+
```
78+
79+
## LINKS
80+
81+
- [SE:07 Encryption](https://learn.microsoft.com/azure/well-architected/security/encryption)
82+
- [Harden a Microsoft Entra Domain Services managed domain](https://learn.microsoft.com/entra/identity/domain-services/secure-your-domain)
83+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.aad/domainservices)

‎docs/en/rules/Azure.EntraDS.TLS.md

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
---
2+
reviewed: 2024-04-27
3+
severity: Critical
4+
pillar: Security
5+
category: SE:07 Encryption
6+
resource: Entra Domain Services
7+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.EntraDS.TLS/
8+
---
9+
10+
# Disable TLS v1
11+
12+
## SYNOPSIS
13+
14+
Disable TLS v1 for Microsoft Entra Domain Services.
15+
16+
## DESCRIPTION
17+
18+
By default, Microsoft Entra Domain Services enables the use of ciphers and protocols such as TLS v1.
19+
These ciphers may be required for some legacy applications, but are considered weak and can be disabled if not required.
20+
21+
Older TLS versions such as 1.0 and 1.1 are no longer considered secure by industry standards, such as PCI DSS.
22+
23+
## RECOMMENDATION
24+
25+
Consider disabling TLS v1 which is considered weak and can be disabled if not required.
26+
27+
## EXAMPLES
28+
29+
### Configure with Azure template
30+
31+
To deploy domains that pass this rule:
32+
33+
- Set the `properties.domainSecuritySettings.tlsV1` property to `Disabled`.
34+
35+
For example:
36+
37+
```json
38+
{
39+
"type": "Microsoft.AAD/domainServices",
40+
"apiVersion": "2022-12-01",
41+
"name": "[parameters('name')]",
42+
"location": "[parameters('location')]",
43+
"properties": {
44+
"ldapsSettings": {
45+
"ldaps": "Enabled"
46+
},
47+
"domainSecuritySettings": {
48+
"ntlmV1": "Disabled",
49+
"tlsV1": "Disabled",
50+
"kerberosRc4Encryption": "Disabled"
51+
}
52+
}
53+
}
54+
```
55+
56+
### Configure with Bicep
57+
58+
To deploy domains that pass this rule:
59+
60+
- Set the `properties.domainSecuritySettings.tlsV1` property to `Disabled`.
61+
62+
For example:
63+
64+
```bicep
65+
resource ds 'Microsoft.AAD/domainServices@2022-12-01' = {
66+
name: name
67+
location: location
68+
properties: {
69+
ldapsSettings: {
70+
ldaps: 'Enabled'
71+
}
72+
domainSecuritySettings: {
73+
ntlmV1: 'Disabled'
74+
tlsV1: 'Disabled'
75+
kerberosRc4Encryption: 'Disabled'
76+
}
77+
}
78+
}
79+
```
80+
81+
## LINKS
82+
83+
- [SE:07 Encryption](https://learn.microsoft.com/azure/well-architected/security/encryption)
84+
- [Harden a Microsoft Entra Domain Services managed domain](https://learn.microsoft.com/entra/identity/domain-services/secure-your-domain)
85+
- [DP-3: Encrypt sensitive data in transit](https://learn.microsoft.com/security/benchmark/azure/baselines/azure-active-directory-domain-services-security-baseline#dp-3-encrypt-sensitive-data-in-transit)
86+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.aad/domainservices)

‎docs/examples-entrads.bicep

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
// Copyright (c) Microsoft Corporation.
2+
// Licensed under the MIT License.
3+
4+
targetScope = 'resourceGroup'
5+
6+
@sys.description('The name of the resource.')
7+
param name string
8+
9+
@sys.description('The location resources will be deployed.')
10+
param location string = resourceGroup().location
11+
12+
// Bicep documentation examples
13+
14+
// Configure a hardened Entra Domain Services instance.
15+
resource ds 'Microsoft.AAD/domainServices@2022-12-01' = {
16+
name: name
17+
location: location
18+
properties: {
19+
ldapsSettings: {
20+
ldaps: 'Enabled'
21+
}
22+
domainSecuritySettings: {
23+
ntlmV1: 'Disabled'
24+
tlsV1: 'Disabled'
25+
kerberosRc4Encryption: 'Disabled'
26+
}
27+
}
28+
}

‎docs/examples-entrads.json

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"metadata": {
5+
"_generator": {
6+
"name": "bicep",
7+
"version": "0.26.170.59819",
8+
"templateHash": "11147541802368036352"
9+
}
10+
},
11+
"parameters": {
12+
"name": {
13+
"type": "string",
14+
"metadata": {
15+
"description": "The name of the resource."
16+
}
17+
},
18+
"location": {
19+
"type": "string",
20+
"defaultValue": "[resourceGroup().location]",
21+
"metadata": {
22+
"description": "The location resources will be deployed."
23+
}
24+
}
25+
},
26+
"resources": [
27+
{
28+
"type": "Microsoft.AAD/domainServices",
29+
"apiVersion": "2022-12-01",
30+
"name": "[parameters('name')]",
31+
"location": "[parameters('location')]",
32+
"properties": {
33+
"ldapsSettings": {
34+
"ldaps": "Enabled"
35+
},
36+
"domainSecuritySettings": {
37+
"ntlmV1": "Disabled",
38+
"tlsV1": "Disabled",
39+
"kerberosRc4Encryption": "Disabled"
40+
}
41+
}
42+
}
43+
]
44+
}

0 commit comments

Comments
 (0)