MySQL Database Server Should Enforce SSL Connection

Using Console

Sure, here are the step-by-step instructions to remediate the MySQL Database Server Should Enforce SSL Connection misconfiguration in Azure using the Azure console:

Log in to the Azure portal (https://portal.azure.com/).
Navigate to the Azure Database for MySQL server that you want to remediate.
Click on the “Connection security” option under the “Security” section in the left-hand menu.
In the “Connection security” section, toggle the “Enforce SSL connection” option to “Enabled”.
Click the “Save” button at the top of the page to save the changes.
Once the changes are saved, the MySQL database server will now enforce SSL connections.

That’s it! By following these steps, you have successfully remediated the MySQL Database Server Should Enforce SSL Connection misconfiguration in Azure using the Azure console.

Using CLI

To remediate the MySQL Database Server Should Enforce SSL Connection misconfiguration in Azure using Azure CLI, you can follow the below steps:

Open the Azure CLI and log in to your Azure account using the command az login.
Once you are logged in, select the Azure subscription that contains your MySQL database by using the command az account set --subscription <subscription_id>.
Next, retrieve the resource ID of your MySQL server using the command az mysql server list --resource-group <resource_group_name> --query [0].id --output tsv.
Now, enable SSL enforcement for the MySQL server by running the command az mysql server update --resource-group <resource_group_name> --name <mysql_server_name> --ssl-enforcement Enabled.
Finally, verify that SSL enforcement is enabled by running the command az mysql server show --resource-group <resource_group_name> --name <mysql_server_name> --query sslEnforcement.

If the output of the above command is “Enabled”, then SSL enforcement has been successfully enabled for your MySQL server in Azure.

Using Python

To remediate the misconfiguration of MySQL Database Server Should Enforce SSL Connection in AZURE, you can follow the below steps using Python:

First, you need to install the ‘azure-mgmt-rdbms’ package. You can install it using the following command:

pip install azure-mgmt-rdbms

Next, you need to authenticate to your Azure account. You can use the following code to authenticate:

from azure.common.credentials import ServicePrincipalCredentials

# Replace the values with your own
subscription_id = 'your_subscription_id'
client_id = 'your_client_id'
secret = 'your_client_secret'
tenant = 'your_tenant_id'

credentials = ServicePrincipalCredentials(
    client_id=client_id,
    secret=secret,
    tenant=tenant
)

After authentication, you need to create a client object for the Azure Database for MySQL server. You can use the following code to create the client object:

from azure.mgmt.rdbms.mysql import MySQLManagementClient
from azure.mgmt.rdbms.mysql.models import ServerForUpdate

# Replace the values with your own
resource_group_name = 'your_resource_group_name'
server_name = 'your_server_name'
location = 'your_server_location'

client = MySQLManagementClient(
    credentials=credentials,
    subscription_id=subscription_id
)

server = client.servers.get(resource_group_name, server_name)

Once you have the client object, you can update the server configuration to enforce SSL connection. You can use the following code to update the server configuration:

server.ssl_enforcement = 'Enabled'

server_for_update = ServerForUpdate(
    ssl_enforcement=server.ssl_enforcement
)

client.servers.begin_create_or_update(
    resource_group_name=resource_group_name,
    server_name=server_name,
    parameters=server_for_update
)

Finally, you can verify if the SSL connection is enforced by checking the server configuration. You can use the following code to check the server configuration:

server = client.servers.get(resource_group_name, server_name)

if server.ssl_enforcement == 'Enabled':
    print('SSL connection is enforced')
else:
    print('SSL connection is not enforced')

That’s it! You have successfully remediated the misconfiguration of MySQL Database Server Should Enforce SSL Connection in Azure using Python.

Using Terraform

resource "azurerm_mysql_server" "MYSQL_SERVER" {
  name                = "MYSQL_SERVER_NAME"            # substitute your MySQL server name
  location            = "AZURE_LOCATION"               # e.g. westus2
  resource_group_name = "RESOURCE_GROUP_NAME"

  administrator_login          = "ADMIN_USERNAME"
  administrator_login_password = "ADMIN_PASSWORD"

  sku_name   = "MYSQL_SKU_NAME"                        # e.g. GP_Gen5_2
  storage_mb = 51200
  version    = "5.7"

  # Enforce SSL connections (remediates the finding)
  ssl_enforcement_enabled = true

  # (optional but recommended) enforce minimum TLS version
  # ssl_minimal_tls_version_enforced = "TLS1_2"

  backup_retention_days            = 7
  geo_redundant_backup_enabled     = false
  auto_grow_enabled                = true
  public_network_access_enabled    = true
  infrastructure_encryption_enabled = false

  tags = {
    Environment = "ENVIRONMENT_TAG"
  }
}

Changing ssl_enforcement_enabled from false to true is an in-place update and does not force replacement of the server.To verify, terraform plan should show a single in-place change on this resource, with ssl_enforcement_enabled changing from false (or null) to true.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

MySQL Database Server Should Enforce SSL Connection

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​