News for hackers. Stuff that matters.

A comment on Azure requires internet accessible ports to monitor your back end instances.

Re:Azure requires internet accessible ports to monitor your ... by FuckOffNeemo on Monday June 11, 2018 @08:15PM (#17289729)
Can anyone else comment here if HTTP (not HTTPS) can use PKI for authentication?

I'm not aware of anyway of this being possible?

The sensitivity of the data or threat risk of the host from these open ports is up for debate and probably should be reverse engineered in any which case.

Could these services be secured by another method that we've missed?

It's undoubtedly bad practice. But surely M$ haven't just left two non-standard HTTP ports open to the internet from all hosted Azure instances?

[ Parent | on HN ]
Re:Azure requires internet accessible ports to monitor your ... by chris408 on Monday June 11, 2018 @08:23PM (#17289765)
I agree, it seems strange that these ports are open, which is why I wrote this up. I spoke with Microsoft on the phone and they confirmed that the ports must be open for their SLA checks and monitoring to work properly.

To reconfirm this, I ran a quick test and saw these ports open by default after I configured an application gateway on my account.

[ Parent | on HN ]
Re:Azure requires internet accessible ports to monitor your ... by FuckOffNeemo on Tuesday June 12, 2018 @01:46AM (#17290973)
Yeah... It's all quite odd.
[ Parent | on HN ]
Re:Azure requires internet accessible ports to monitor your ... by chris408 on Tuesday June 12, 2018 @01:52AM (#17290998)
Apparently they don’t have a mechanism to permit their own addresses because the probes come from dynamic addresses. It sounded like they were adding this as a predefined label in the future.
[ Parent | on HN ]
Re:Azure requires internet accessible ports to monitor your ... by chopin on Tuesday June 12, 2018 @09:23AM (#17292950)
Afaik the standard does not support this, therefore a browser does not support it. If you control both endpoints one could set this up. But what's the point of you do? You would certainly be open for monitoring and altering traffic still. Unless you implement your own variety of https.
[ Parent | on HN ]