This is Part 16 of azure tutorial. In this video, we'll discuss azure just-in-time VM access
feature. So, what is just in time virtual machine access? Well, hackers always scan the internet
for open ports like RDP or SSH. If you have a port open all the time,
it's a potential target for an attack. When one of the VMs in your network is breached,
it can be used as the entry point to attack other servers and resources within your environment.
Just-in-time VM access reduces the attack surface area by opening the inbound ports just
when you need them and are automatically closed after the specified duration has elapsed. So,
how to enable just-in-time VM access. Well, there are two ways. We can either enable it
from the virtual machine itself or from azure security center. Here is the virtual machine that
we created in our previous video, vm-pragimtech. Let's navigate to this virtual machine and then
get to the "Networking" blade. Notice, we have an inbound port rule here. We created this rule in
our previous video. Basically, we opened this port 3389 for RDP communication. The problem with this
inbound port rule is, this port is always open and the moment attackers see that this port is open,
it can be used as a potential target for an attack and once a VM within your network is breached,
it can be used as an entry point to attack further resources within your environment. Now,
let's navigate to the "Connect" blade and notice the message that we have here - To
improve security enable just-in-time access on this VM. We'll get to this in just a bit. First,
let's download the RDP file and then remotely log into our virtual machine in azure.
There we go, we are able to successfully login. Now, let's disconnect and get back to azure
portal. Before, we enable just-in-time access on this VM, let's go to the "Networking" blade
once and pay attention to the priority of this inbound port role. At the moment it is 100. Now,
let's see what's going to happen after we enable JIT VM access. So, let's go to the "Connect" tab
and then click this link - Enable just in time access on this VM". What it does is, navigates
us to the "Configuration" blade and on this blade we have this button - Enable just in time. So,
this is one of the ways. If you want to enable just in time VM access, you go to the virtual
machine itself, click on the "Configuration" blade and there you have it, "Enable just in
time". So, let's click this button. There we go, just-in-time VM access is successfully enabled.
Now, let's go back to the "Networking" blade. Notice, we have a new inbound rule here and
notice the name of this rule - Security center jit rule. So, by looking at this name, we can be sure,
this rule is automatically added by azure when we enabled just-in-time VM access and what it's doing
basically is, it's denying access to this port 3389 from any source and from
any protocol. Look at the destination here. The IP address is 10.0.0.4. Basically,
if you take a VM in azure, it has two IP addresses - one is private ip address and the other one
is public ip address. We use the public ip address to communicate with this VM from the internet and
private ap address stays private within the azure network. So, basically what we see here
is the private ip address. Basically this rule here which is added by azure automatically,
when we enabled just-in-time VM access blocks the incoming traffic to this port number 3389 and here
is the interesting bit. Look at the priority. The priority for this rule is 1000 and here is the
rule that we added in our previous video. Notice, the priority of this rule is now adjusted to be a
higher number than this rule. So, basically rules with lower priority win, that means this deny rule
will win over the allow rule. So if we try to connect to our VM using RDP right now,
it should fail. So, let's try that. Let's launch the RDP client. So, go to the run window. Type
"mstsc", click OK. To RDP into our virtual machine we need to use this public IP address
20.55.8.53: the port number 3389. So, let's click connect. It's trying to
remotely connect to our virtual machine in azure. Let's give it a few seconds and see
what's going to happen. Eventually, it should fail with an error. There we go, remote desktop
connection error. At the moment, I'm not able to remotely connect to our virtual machine in azure,
but I want to connect to it now. So, how do I do it? Well, we have to request access and we can do
that in two ways. One is from the "Connect" tab. So, here we have this button here - Request Access
or we can do it from azure security center. We have a link for azure security center on
the "Configuration" blade. When we click this link, it takes us to azure security center. So,
here we have our VM. Notice, at the moment we are on the "Configuration" tab and to request access,
click this button - Request Access. Here is the interesting bit, we are basically requesting
this port 3389 to be opened for RDP communication. At the moment, it's off, we want to turn it on,
and how do we want to connect to this VM. Now, when I select "My IP", basically it's going to use
the IP address of my laptop, which I have used to log into azure portal. This means,
I can only remotely connect from my laptop now. We can also specify IP range, that is multiple
IP addresses. Maybe, for example, we want to grant access, you know, to myself as well as to
two other colleagues of mine. I can specify multiple IP addresses if I want to, or a range
of IP addresses and then finally, the duration for how long you want this port to be open. Maybe, we
want it to be opened for just one hour. So, let's adjust the time and then optionally you can also
enter the justification for why we are opening this port and then click this button - Open Ports.
There we go, our request is approved and we can edit this again if we want to. For that, click
on this ellipsis button and then - Edit. Once we click on this request here, we see the interface
to edit it. Now, if you look at the duration, I remember I have specified one hour. Maybe,
I didn't save it, that's why we still see the default three hours. Let's change it to one and
then click ok. So, now it is one hour. Let's save it. Go back to our VM and let's take a look at
the inbound port rules. We have a new inbound port rule. So, basically to this port 3389 we have an
"allow" rule. Look at the priority number of this rule, it is 100, less than this "deny" rule. So,
this allow rule is going to win, meaning we will have access now to our VM. Let's try that.
Enter the password.
There we go, we are now remotely connected and logged in. Now, here's the important bit to keep
in mind, when we requested access to this VM, we specified the duration as one hour. Now, what
do you think is going to happen to this inbound port rule after that one hour has elapsed? Well,
this rule will be automatically deleted and we will not have access and that's a good thing. So,
just-in-time VM access reduces the attack surface area by opening the inbound ports just when you
need them and are automatically closed after the specified duration has elapsed. So, with JIT
VM access, you can configure the following three things. Which port you want to open? In our case,
it is 3389 for RDP communication. From which IP address you want to allow access. You can also
specify a range, if you want to, and finally, the duration in hours, for which you want this port
to be open. After that specified duration has expired, the corresponding inbound port role is
automatically deleted and we will not have access. That's it in this video. Thank you for listening.