Allow only encrypted connection to Azure SQL Server

Question

Hello,
is there a setup on Azure Sql Server thath permits only enrypted connection ?
I was horrified to find out my SSMS is using an unecrypted connection from my laptop to azure because the checkbox value is remembered from previous connection to a local sql server.

Is it a good practice to connect to Azure Sql Server via the Internet with only source ips restricted ?
I've tried a ssh tunnels through a Linux VM in azure but it is not working.
Should I rather setup a VPN server on a VM machine ? Do you recommend any VPN server software on Linux that would be connected from Windows desktops ?

Is there a best practice documentation pointing this issue? Eg. Use only Virtual Private Network to connect to Azure SQL and VPN.

Jan.

Answer 1

All connections coming from SSMS to Azure SQL are encrypted even if the you don't set "Encrypt connection" setting on. Azuire SQL Database only allows encrypted connections.

When a client first attempts a connection to SQL Azure, it sends an initial connection request. Consider this a "pre-pre-connection" request. At this point the client does not know if SSL/Encryption is required and waits an answer from SQL Server/SQL Azure to determine if SSL is indeed required throughout the session (not just the login sequence, the entire connection session). A bit is set on the response indicating so. Then the client library disconnects and reconnects armed with this information.

When you set "Encrypt connection" setting on SSMS you avoid the "pre-pre-connection", you are preventing any proxy from turning off the encryption bit on the client side of the proxy, this way attacks like man-in-the-middle attack are avoided.

When secure connections are needed, please enable "Encrypt connection" setting.

You can run the following command to verify all connections to Azure SQL are encrypted:

select * from sys.dm_exec_connections.

Answer 2

@Alberto Morillo
Thanks for a reply. Is there an explicit setup on Sql Server to enforce encryption? We also run on premise instances.
Also I've confirmed by Microsoft Network Monitor that connection is encrypted.