How to disable inbound UDP for Azure services

The monlist service in NTP provides the ability to run queries for debugging information and should only be temporarily enabled for debugging a service issue. It can also be used to undertake UDP reflection attacks. In NTP Daemon (NTPD) packages older than 4.2.8, this service is enabled by default.  Users should follow this guidance:

• Users who require monlist should configure an NSG to allow access to only required IP addresses.

• Users who do not require monlist  and are running Linux NTPD packages older than version 4.2.8 should update the package to a current version and make sure that monlist is not enabled. Users who cannot update the package to a newer version will Have to configure the service by using the  following remediation steps:

1. Check for the version of the NTPD package:

#sudo -i ntpq -c rv

1. If the version of the NTPD package is earlier than 4.7p26, follow these steps:

#vi /etc/ntp.conf

1. If they do not already exist, add these lines:

restrict -4 default kod nomodify notrap nopeer noquery

restrict -6 default kod nomodify notrap nopeer noquery

1. Restart the NTP service:

# service ntp restart [Debian/ Ubuntu]

# service ntpd restart [Redhat/ Centos]

Running a DNS recursive resolver open to the internet can cause a UDP attack against a user's own service and those of other users. Users should evaluate whether they actually must have a DNS service running. If they do not, they should either deny all access to Port 53 or uninstall the DNS service by following the instructions that are specific to their operating system and DNS implementation.

User who do require a DNS service to be running to provide authoritative name resolution but who do not require DNS recursion should disable this feature by following the instructions that are specific to their operating system and DNS implementation (as provided later in this article). Additionally, we strongly recommended in all cases that access to Port 53 in your NSG be restricted to the specific set of IP addresses that are required to operate your service by having the least privileges.

Windows: Disable DNS recursive resolver setting on DNS Server for Windows server 2012, 2016

1. Open DNS Manager (select Start, point to Administrative Tools, and then select DNS).

2. In the console tree, right-click the applicable DNS server, and then select Properties.

3. Select the Advanced tab.

4. In Server options, make sure that the Disable recursion check box isselected.

5. Restart the DNS service (from the Services control panel).

Linux: Disabling DNS recursion on your Bind server

1. Connect to your server through SSH (Secure Shell) by using your root credentials.

2. After you connect to your server, check your named.conf file for any DNS recursion, and investigate the settings:
   

   cat /etc/named.conf | grep "recursion"

3. Open your named.conf file by using any text editor, and check the settings for recursion by using the following command:
   

   #vi /etc/named.conf

4. Change the settings for external DNS recursion only, and locate the section that is named “external.” If the section is not available, you can add the following lines to your named.conf file to disable the external DNS recursion. Put the following lines in the “options” section:
   

   allow-transfer {"none";};

   allow-recursion {"none";};

   recursion no;

   If you already have the external section, you can change its settings by changing the recursion value to yes or no, depending on your needs.

5. After configuring your changes, save the file.

6. Restart the DNS server for the changes to take effect. Run the following command to restart your DNS service:
   

   service named restart

   Note: If you are using any other proprietary DNS server, refer to respective product documentation to disable DNS recursive setting.

Users should close high-risk inbound UDP ports by following the guidance in this section. We recommended that users close inbound connections from the internet on all UDP ports.

Users who must open a specific UDP port to the internet should open that port only and reastrict inbound access to those IP ranges that are strictly necessary (that is, do not expose UDP ports to the entire internet).

To close the UDP ports, users can take either or both of the following actions:

• Update their ARM template to disable inbound UDP. This requires NSG template redeployment. However, it makes sure that future deployments that use this template will have the correct security settings.

• Update the NSG rules to restrict network access. See Azure Portal, Azure Powershell, Azure CLI.

Resources: Information on NSGs , Manage Network Security Group (NSG)

1. Install Nmap.

2. Check the firewall settings to make sure that you are allowing outbound UDP traffic to run the scan.

3. Follow the Nmap instructions in this section about how to perform a scan. Users can also use the Zenmap GUI (the icon is installed on the desktop when Windows Nmap is installed).

   1. Create a .csv file that has a list of IP addresses to scan for a specific port (for example, Port 69).

   2. Run the Nmap command. You can include these options: -sUV (UDP ports) -T4 -p {port to scan} -Pn {treat all hosts as online} -iL {input list} -oL {output list} & (optional flag to run in background):
      
      nmap -sUV -T4 -Pn -p 69 -iL filename.csv -oX filename.xml &
      

   3. Check the ports that are most commonly used in reflection attacks:
      
      nmap -sUV -T4 -Pn -p17,19,53,69,111,123,137,161,389,1900,5353,11211 -iL filename.csv -oX filename.xml &

   4. Review the results to identify any open ports.

1. Install Nmap through the package manager or from https://nmap.org/download.html.

Ubuntu / Debian :

sudo apt-get update
sudo apt-get install nmap

Redhat / CentOS:

yum update
yum install nmap [Redhat/ Centos]

1. Use the following Nmap commands to verify known UDP ports:

   1. Create a .csv file that includes a list of IP addresses to scan for a specific port (for example, Port 69).

   2. Upload the .csv file to your Linux VM by using the pscp command:
      
      pscp filename.csv admin@remotehost:filename.csv

   3. Run the sudo nmap command including the options -sUV (UDP ports) -T4 -p {port to scan} -Pn {treat all hosts as online} -iL {input list} -oL {output list} & (optional flag to run in background):
      
      sudo nmap -sUV -T4 -Pn -p 69 -iL filename.csv -oX filename.xml &

   4. Check the ports that are most commonly used in reflection attacks:
      
      sudo nmap -sUV -T4 -Pn -p17,19,53,69,111,123,137,161,389,1900,5353,11211 -iL filename.csv -oX filename.xml &

   5. When the process is finished, download the file by using pscp command.

   6. Review the results to identify any open ports.
      

Run a Windows scan from the command line by having all ports closed.

Note Because this is an Nmap UDP scan, "open|filtered" can be interpreted as "closed."

The following command runs a Windows scan:

C:\Users\user\DeskTop>nmap -sUV -T4 -Pn -p17,19,53,69,111,123,137,161,389,1900,5353,11211 23.36.53.224

Run a Linux scan for 1.1.1.1 by having DNS open. Notice that DNS port 53 does not say "open|filtered" because this would indicate that the port is closed. However, the other ports are shown as "open|filtered." This indicates that they are closed.

The following command runs a Linux scan:

testuser@testUbuntu:~$ sudo nmap -sUV -T4 -Pn -p17,19,53,69,111,123,137,161,389,1900,5353,11211 1.1.1.1

To scan for open DNS recursive resolvers:

nmap -sUV -Pn -T4 -p 53 --script=dns-recursion -iL <input_file> -oX <output_file>

For a single IP address:

nmap –sU –p53 –script=dns-recursion <Public IP address>

NTPD package versions that are earlier than 4.2.8 are vulnerable to UDP reflection attacks through a monlist command. If “restrict noquery” is configured, a monlist reflection attack would not work.

Nmap script to identify the vulnerability:

nmap -sUV -Pn -T4 -p 123 --script= ntp-monlist -iL <input_file> -oX <output_file>

For a single IP address:

nmap -sU -pU:123 -Pn -n --script=ntp-monlist <Public IP address>

nmap -sU -p389 -v -n -Pn <Public IP address>

Show Publicly exposed LDAP information:

nmap -p 389 --script ldap-rootdse <Public IP address>

This is not a recommended configuration. However, if the user has a dependent service, they should add additional security by using signing per the following guidance:

• https://support.microsoft.com/en-us/help/935834/how-to-enable-ldap-signing-in-windows-server

• ​https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV190023

Users should use the following documents for how to configure Time Sync for their Azure VMs. If the user uses a vulnerable package for Linux or Windows NTPD, they should update to the current version.

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/time-sync#opt-in-for-host-only-time-sync

• https://docs.microsoft.com/en-us/azure/virtual-machines/linux/time-sync

Learn how to troubleshoot by using Azure Network Watcher: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-connectivity-overview

No. These are the standard ports for the UDP services. However, either the services can be listening on another port number or the server can exist behind a load balancer that port forwards from another source port.

See UDP Amplification: https://www.us-cert.gov/ncas/alerts/TA14-017A