Chi tiết các phương pháp Remote Access vào VM Azure

 

Chi tiết các phương pháp Remote Access vào VM Azure

1. Remote Access vào VM Azure

a) SSH/RDP (Traditional)

# SSH vào Linux VM
ssh -i ~/.ssh/mykey.pem azureuser@vm-public-ip

# RDP vào Windows VM (sử dụng Remote Desktop Client)
mstsc /v:vm-public-ip

b) Azure Bastion (Recommended)

bash
# Tạo Azure Bastion
az network bastion create \
  --resource-group myRG \
  --name myBastion \
  --public-ip-address myBastionIP \
  --vnet-name myVNet \
  --location eastus

c) VPN Gateway

bash
# Tạo Point-to-Site VPN
az network vnet-gateway create \
  --resource-group myRG \
  --name myVPNGW \
  --vnet myVNet \
  --public-ip-addresses myGWIP \
  --gateway-type Vpn \
  --vpn-type RouteBased \
  --sku VpnGw1 \
  --vpn-gateway-generation Generation1

d) Run Command Extension

bash
# Chạy command từ xa mà không cần SSH
az vm run-command invoke \
  --resource-group myRG \
  --name myVM \
  --command-id RunShellScript \
  --scripts "sudo apt update && sudo apt install -y nginx"

2. Remote Access vào AKS

a) kubectl (Primary method)

bash
# Lấy credentials
az aks get-credentials --resource-group myRG --name myAKS

# Verify connection
kubectl get nodes

# Tích hợp Azure AD
az aks update \
  --resource-group myRG \
  --name myAKS \
  --enable-aad \
  --aad-admin-group-object-ids $ADMIN_GROUP_ID

b) Azure Cloud Shell

bash
# Truy cập từ portal.azure.com
# Cloud Shell có sẵn kubectl, helm, và Azure CLI
kubectl apply -f deployment.yaml

c) Kubernetes Dashboard

bash
# Enable dashboard
kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.7.0/aio/deploy/recommended.yaml

# Create service account và get token
kubectl create serviceaccount dashboard-admin -n kube-system
kubectl create clusterrolebinding dashboard-admin \
  --clusterrole=cluster-admin \
  --serviceaccount=kube-system:dashboard-admin

# Proxy để access dashboard
kubectl proxy

3. Cấp quyền cho Vendor

a) Time-limited Access (Recommended)

bash
# Tạo Azure AD PIM role assignment
az role assignment create \
  --assignee vendor@external.com \
  --role "Azure Kubernetes Service Cluster User Role" \
  --scope /subscriptions/$SUB_ID/resourcegroups/$RG/providers/Microsoft.ContainerService/managedClusters/$AKS_NAME \
  --condition "{'startDateTime':'2024-01-15T09:00:00Z','endDateTime':'2024-01-15T17:00:00Z'}"

b) Guest User với Limited Scope

bash
# Invite guest user
az ad user invite \
  --invited-user-email-address vendor@external.com \
  --invite-redirect-url "https://portal.azure.com"

# Assign limited role
az role assignment create \
  --assignee vendor@external.com \
  --role "Azure Kubernetes Service Cluster User Role" \
  --resource-group myRG

c) Service Principal cho Automation

bash
# Tạo service principal
az ad sp create-for-rbac \
  --name "vendor-sp" \
  --role "Azure Kubernetes Service Cluster User Role" \
  --scopes /subscriptions/$SUB_ID/resourcegroups/$RG

# Output sẽ có appId, password, tenant cần share với vendor

d) Namespace-specific Access

yaml
# rbac-vendor.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: vendor-binding
  namespace: vendor-apps
subjects:
- kind: User
  name: vendor@external.com
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: namespace-admin
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: vendor-apps
  name: namespace-admin
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

4. Security Best Practices cho Vendor Access

a) Network Restrictions

bash
# Chỉ cho phép IP cụ thể
az network nsg rule create \
  --resource-group myRG \
  --nsg-name myNSG \
  --name AllowVendorSSH \
  --protocol Tcp \
  --direction Inbound \
  --priority 1000 \
  --source-address-prefixes 203.0.113.0/24 \
  --destination-port-ranges 22

b) Conditional Access Policy

bash
# Tạo conditional access policy qua Azure Portal
# Yêu cầu:
# - MFA enabled
# - Managed devices only
# - Specific locations
# - Time-based access

c) Monitoring & Alerting

bash
# Setup audit log monitoring
az monitor activity-log alert create \
  --resource-group myRG \
  --name VendorAccessAlert \
  --scopes /subscriptions/$SUB_ID \
  --condition category=Administrative \
  --action-groups myActionGroup

5. Vendor Access Workflow

Step 1: Pre-approval

1. Vendor request với justification
2. Security team review
3. Define scope và duration
4. Approve với conditions

Step 2: Access Provisioning

bash
# Temporary access script
#!/bin/bash
VENDOR_EMAIL="vendor@external.com"
END_TIME=$(date -d "+8 hours" -u +"%Y-%m-%dT%H:%M:%SZ")

# Grant temporary access
az role assignment create \
  --assignee $VENDOR_EMAIL \
  --role "Azure Kubernetes Service Cluster User Role" \
  --scope $AKS_SCOPE \
  --condition "{'endDateTime':'$END_TIME'}"

echo "Access granted until $END_TIME"

Step 3: Access Monitoring

bash
# Monitor vendor activities
kubectl get events --sort-by=.metadata.creationTimestamp
az monitor activity-log list --caller $VENDOR_EMAIL

Step 4: Access Revocation

bash
# Auto-revoke script
az role assignment delete \
  --assignee $VENDOR_EMAIL \
  --role "Azure Kubernetes Service Cluster User Role" \
  --scope $AKS_SCOPE

6. Alternative: Shared Screen Session

• Sử dụng Microsoft Teams/Zoom screen sharing
• Vendor hướng dẫn, khách hàng thực hiện
• Record session để audit
• Không cần cấp direct access

Phương pháp này đảm bảo security cao nhất while vẫn cho phép vendor support effectively.