0

I need to develop a script on azure automation (Powershell)that runs all VMs in subscription and checks every 1 hour if a VM has the SSH port open, if that port is open than i close it automatically . Thank you for helping me with information and tutorials as I am still a beginner in cloud computing

the check and the close it of the ssh port probably using the nsg

Chakroun Fatma
  • 1
  • 1

1 Answers1

0

I would probably do this in two steps:

  1. Create a runbook which uses the Search-AzGraph cmdlet from the Az.ResourceGraph module. Here is an example query that retrieves all NSG rules using Resource Graph: https://blog.blksthl.com/2020/10/02/list-all-nsg-security-rules-in-one-query-using-azure-resource-graph/

  2. Create a 2nd runbook for remediation, that uses Set-AzNetworkSecurityGroup and takes parameters to remediate any detected misconfigured resources.

The benefit of doing it this way is that it's much quicker using the resourceGraph to query all resources than using the native AzVm or Get-AzNetworkSecurityGroup and looping through each resource.

Splitting out the get/set logic into separate runbooks gives you greater visibility, activity logs per runbook and also if you need to change the output from just remediation, you can asynchronously call runbooks so you could e.g. call an action group for an alert then remediate and the logic would be isolated to a specific runbook.

BrettMiller
  • 946
  • 2
  • 5
  • 12
  • it's such a good idea but how can I detect if the port 22 is open or not and how can I close it, Thank you. – Chakroun Fatma Apr 03 '22 at 19:58
  • This is the sticker. You can't just test the port is open because if your NSG only specifies specific ports are open then wherever you test from may not work. You're most likely having to query each NSG within your subscription(s) for ports which need to be closed. – BrettMiller Apr 08 '22 at 07:50