Security and access

Network controls

An NSG (Network Security Group) is applied per subnet. Remote administration access (SSH and RDP) must be restricted to a single source address, the one of the Chancy site:

The only source IP allowed for SSH and RDP

194.148.102.82 — the Chancy outbound IP, and no other. Not your workstation’s address, not your home’s, not a client site’s, and obviously never 0.0.0.0/0, which means “from the entire Internet”. That last one is never acceptable, not even for the length of a test.

In practice: your connection must go out through Chancy for the rule to let you in. From another network, the rule is working fine and you are the one being blocked. If your working situation makes this access impossible, don’t widen the rule: talk to the administrators.

Best practices

• Keep access rights to the strict minimum.
• Don’t put secrets in plain text in the code or configuration of the lab’s resources.
• Document any security exception approved with the administrators.

Applicable rules

NSG and restricted access

My responsibility

One NSG per subnet. SSH and RDP access is restricted to a single allowed source address, the Chancy site: 194.148.102.82. Not your workstation's address, not a client site's, and never 0.0.0.0/0.

MandatoryPR-GOVCLOUDLAB-A-01