Windows web servers should be configured to use secure communication protocols

Question

I have 1 Azure VM named rabbitMQ-rm-1. This machine has Windows (Windows Server 2012 R2 Datacenter). I have installed only RabbitMQ 3.8.11 and the latest Erlang OTP 23 installers. Basically, this machine provides a scalable platform for sending and receiving messages with the help of the RabbitMQ message broker.

In the Azure Portal, I have allowed only inbound port rule 5672 port in the Network security group. I have gone through the given articles but Windows web servers should be configured to use secure communication protocols is not getting resolved.

In Advisor recommendations facing following issues

1. All network ports should be restricted on network security groups associated with your virtual machine
2. Windows web servers should be configured to use secure communication protocols

Can you please help me to resolve these issues?

Answer 1

@Stephen P

Have a look at the exact compliance reason in the recommendation.

In my case, on my end it said GCExtensionInstalled=False;MSIEnabled=False;UserIdentityEnabled=False

This is what I did to fix it:

A. GCextensionInstalled:

Install the Guest Configuration extension on your VM - I did this via Azure CLI:

az account set --subscription "MY SUBSCRIPTION NAME"
select-azsubscription - subscriptionname "MY SUBSCRIPTION NAME"
az vm extension set --publisher Microsoft.GuestConfiguration --name ConfigurationforWindows --extension-instance-name AzurePolicyforWindows --resource-group MYRESOURCEGROUP --vm-name MYVM

B. MSIEnabled:

Don't go looking for installation (msi) options. This means your VM doesn't have a Managed System Identity

To fix this, follow this article: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm

Or in short, open the Azure PORTAL, go to your VM - Settings - Identity and enable the System Assigned Identity.

C. UserIdentityEnabled:

• First, Go to "Managed Identities" in the portal
• Create a new Managed Identity (select subscription, resource group), put it in the right region and give it a RECOGNIZABLE name (eg MY-USER-IDENTITY-VM)
• Next, go to your VM again
• Next, go to Settings - Identity
• Now, select User Assigned Identities
• Click Add
• Select the User Assigned Identity that you just created (eg MY-USER-IDENTITY-VM)

D. Now, rerun the compliancescan

In my case, my test case VM was in an isolated resource group, so I ran this command:

start-azpolicycompliancescan -resourcegroupname 'my-isolated-resource-group'

An hour later, my VM was marked compliant.

Answer 2

I think this detection is just broken:

Even https://github.com/Azure/azure-policy/blob/5ee685dc5b31e652576460d41c0dd338fc4c282d/samples/GuestConfiguration/package-samples/resource-modules/SecureProtocolWebServer/DSCResources/SecureWebServer/SecureWebServer.psm1#L351C10-L359 returns false on our machines the compliance state is

        "resources": [
            {
                "complianceStatus": "false",
                "resourceId": "[SecureWebServer]s1",
                "properties": null,
                "reasons": [
                    {
                        "phrase": "Could not find any secure TLS protocol version enabled on this server. \n",
                        "code": "SecureProtocolWebServer:SecureWebServer:SecureTLSProtocolNotEnabled"
                    },
                    {
                        "phrase": "Displaying current status of protocols: \nSSL 2.0 - Absent \nSSL 3.0 - Absent \nTLS 1.0 - Absent \nPCT 1.0 - Absent \nMulti-Protocol Unified Hello - Absent \nTLS 1.1 - Absent \nTLS 1.2 - Absent \n",
                        "code": "SecureProtocolWebServer:SecureWebServer:DisplayProtocolInfo"
                    }
                ]
            }
        ]

Why should we configure TLS 1.1 or TLS 1.2 if we are not running any server processes or IIS?