one Traffic manager and multiple DNS mapping (pls need clarification on how security is ensured)

[kirankumar_azurecloud925]

Hi Team,

I feel really strange on how Azure Traffic Manager allowing traffic from multiple Custom domains with just adding a CNAME record of traffic manager to them without enforcing any validation of DNS from Azure end.

May be I am wrong, but let me explain in detail:

Here's my setup:

Traffic Manager

\_____ App Gateway(East) & App Gateway(West)

\_WebApp (East) & \_WebApp(West)

A HA setup with applications in East & West.

I've bought Domain from GoDaddy & I added CNAME record pointing to Traffic manager (pqr-tm.trafficmanager.net). I did no additional steps for Domain validation from Azure.

After the DNS propogation happend, the other day when I tired my Custom Domain (lets say pqr.com), it routed to my WebApp as expected as per CNAME record.

Now, when I typed www.prq.com in https://digwebinterface.com
I could see, it resolved first to "traffic manager" (it clearly displaying my traffic manager name), then to Application Gateway DNS and then to Application Gateway Public IP.

Then my friend said, I'll do a trick, I'll get into your site without my notice.

Here's what he did:

he has Domain in Yahoo. lets say - xyz.com

he opened his Yahoo account, went to DNS settings, and in Forward URL option, he kept my traffic manager DNS name which is clearly appearing in https://digwebinterface.com by just typing my website www.prq.com in it.

To my surprise, with in a minute,

when he type xyz.com in browser, my WebApp started rending page.

So, I thought where is security?

Here's my point:

https://digwebinterface.com -- is publicly available

by typing the site name, any one can get Traffic manager URL (if the setup includes it)

then, just by keeping CNAME in their forward URL, if they are able to map my site....where is the security?

or

Am I missed any step in Traffic manager which binds My Domain to it and If any others tries to point their domain to my traffic manager, it rejects?

Pls help!!

I've a strong feeling that, there will be tightening point, which I am not aware of.

Pls guide Guru's :)

Thanks,

Kiran

[#2]

@kirankumar_azurecloud925 

My first thought in reading your scenario is: don’t count on DNS for security.  Here is my point; DNS is just a public record of pointers.  Anyone could just as easily get to the site with the trafficmanager.net URL or, if a web server was hosted directly behind a public IP (like we did in the olden days), anyone could create an A record to point a domain to the IP.  DNS is an old protocol that was not built with security in mind. 

If you need to ensure that only users intending to get to www.prq.com get to your site, the best bet would be to add a certificate to trafficmanager for your custom hostname and enforce SSL.  That way, if anyone tries to spoof the host (xyz.com) the user will get a certificate error.

If you need authentication, check out Azure AD App Proxy or Azure AD Application Gateway.  You can put the site behind these products and force Azure AD authentication before the user accesses the web site.

[#3]

@Travis Roberts  Thanks for your inputs....but I couldn't find any option in Traffic Manager to SSL bind and restrict the traffic there itself. Am I missing anything?

I see we have SSL binding option only at - Application Gateway (HTTPS Listener) and WebApp.

In my case, I did SSL bind at AGW HTTPS listener by uploading PFX. We thought we will go with SSL off-loading at AGW, so I thought of not adding SSL again at WebApp.

Hope that's the right setup where there is

TM for routing requests in HA setup > 

(followed by) App Gateway with WAF enabled (to apply security) & SSL off Load

(followed by) Azure WebApp to serve the request.

Not sure, at least why AGW is not blocking the connections as we did SSL bind at HTTPS listener.

Pls help!!

[#4]

@kirankumar_azurecloud925That sounds correct.  The Cert is added to the proxy offload device or to the endpoints.

Good luck