From 96d8d06c9e57be918ee97b9ef334c3398a9381ed Mon Sep 17 00:00:00 2001 From: Translator Date: Fri, 17 Jul 2026 06:09:59 +0000 Subject: [PATCH] Translated ['', 'src/pentesting-cloud/azure-security/az-services/az-sql. --- .../azure-security/az-services/az-sql.md | 92 ++++----- .../azure-security/az-services/az-storage.md | 186 +++++++++--------- 2 files changed, 139 insertions(+), 139 deletions(-) diff --git a/src/pentesting-cloud/azure-security/az-services/az-sql.md b/src/pentesting-cloud/azure-security/az-services/az-sql.md index 42a3137ee..ec5b1f574 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-sql.md +++ b/src/pentesting-cloud/azure-security/az-services/az-sql.md @@ -4,47 +4,47 @@ ## Azure SQL -Azure SQL ni familia ya bidhaa zinazosimamiwa, salama, na zenye akili zinazotumia **SQL Server database engine katika Azure cloud**. Hii inamaanisha huhitaji kuwa na wasiwasi kuhusu usimamizi wa kimwili wa servers zako, na unaweza kuzingatia kusimamia data yako. +Azure SQL ni familia ya bidhaa zinazosimamiwa, salama, na zenye akili zinazotumia **SQL Server database engine katika Azure cloud**. Hii inamaanisha kwamba huhitaji kuwa na wasiwasi kuhusu usimamizi wa kimwili wa servers zako, na unaweza kulenga kusimamia data yako. -Azure SQL inajumuisha matoleo manne makuu: +Azure SQL ina offerings kuu nne: -1. **Azure SQL Server**: Server inahitajika kwa **deployment and management** ya SQL Server databases. -2. **Azure SQL Database**: Huu ni **fully-managed database service**, unaokuwezesha kuhifadhi individual databases katika Azure cloud. -3. **Azure SQL Managed Instance**: Hii ni kwa deployments za kiwango kikubwa zaidi, zima la SQL Server instance-scoped. -4. **Azure SQL Server on Azure VMs**: Hii ni bora kwa architectures ambapo unataka **control over the operating system **na SQL Server instance. +1. **Azure SQL Server**: Server inahitajika kwa ajili ya **deployment na usimamizi** wa SQL Server databases. +2. **Azure SQL Database**: Hii ni **fully-managed database service**, inayokuruhusu kuh-host databases binafsi katika Azure cloud. +3. **Azure SQL Managed Instance**: Hii ni kwa deployments za kiwango kikubwa zinazohusisha SQL Server instance nzima. +4. **Azure SQL Server on Azure VMs**: Hii inafaa zaidi kwa architectures ambapo unataka **udhibiti wa operating system **na SQL Server instance. ### SQL Server Security Features -**Network access:** +**Ufikiaji wa mtandao:** -- Public endpoint (inaweza kuzuia access kwa specific networks). +- Public endpoint (inaweza kuweka kikomo cha ufikiaji kwa networks maalum). - Private endpoints. -- Inawezekana pia kuzuia connections kulingana na domain names. -- Inawezekana pia kuruhusu Azure services kui access (kama kutumia Query editor kwenye portal au kuruhusu Azure VM kuconnect). -- Ikiwa SQL Server ina *Allow Azure services and resources to access this server* imewekwa kuwa "Enabled", Azure itaunda kiotomatiki hidden firewall rule inayoruhusu network traffic yote inayotoka Azure kuconnect kwa SQL Server — ikijumuisha resources kutoka tenant yoyote. -- Hii inamaanisha kwamba ukipata valid SQL credentials, unaweza kuconnect kwa victim Azure SQL Server kutoka Azure VM ndani ya tenant yako mwenyewe unaoidhibiti kama attacker. [The MS docs explains this](https://learn.microsoft.com/en-us/azure/azure-sql/database/network-access-controls-overview?view=azuresql#allow-azure-services) +- Pia inawezekana kuzuia connections kulingana na domain names. +- Pia inawezekana kuruhusu Azure services kuifikia (kwa mfano kutumia Query editor katika portal au kuruhusu Azure VM ku-connect). +- Ikiwa SQL Server ina *Allow Azure services and resources to access this server* iliyowekwa kuwa "Enabled", Azure itaunda kiotomatiki firewall rule iliyofichwa inayoruhusu network traffic yote inayotoka Azure ku-connect kwenye SQL Server — ikijumuisha resources kutoka tenant yoyote. +- Hii inamaanisha kwamba ukipata SQL credentials halali, unaweza ku-connect kwenye Azure SQL Server ya victim kutoka Azure VM iliyo ndani ya attacker-controlled tenant yako. [The MS docs explains this](https://learn.microsoft.com/en-us/azure/azure-sql/database/network-access-controls-overview?view=azuresql#allow-azure-services) **Authentication Methods:** -- Microsoft **Entra-only** authentication: Unahitaji kuonyesha Entra principals watakaokuwa na access kwa service. -- **Both SQL and Microsoft Entra** authentication: Traditional SQL authentication kwa username na password pamoja na Microsoft Entra. -- **Only SQL** authentication: Ruhusu tu access kupitia database users. +- Microsoft **Entra-only** authentication: Unahitaji kubainisha Entra principals zitakazokuwa na ufikiaji wa service. +- **Both SQL and Microsoft Entra** authentication: Traditional SQL authentication yenye username na password pamoja na Microsoft Entra. +- **Only SQL** authentication: Inaruhusu ufikiaji kupitia database users pekee. -Kumbuka kwamba kama SQL auth yoyote inaruhusiwa admin user (username + password) anahitaji kuonyeshwa na ikiwa Entra ID auth imechaguliwa pia inahitajika kuonyesha angalau principal mmoja mwenye admin access. +Kumbuka kwamba ikiwa SQL auth yoyote inaruhusiwa, admin user (username + password) lazima abainishwe; na ikiwa Entra ID auth imechaguliwa, ni lazima pia kubainisha angalau principal mmoja mwenye admin access. **Encryption:** -- Inaitwa “Transparent data encryption” na inencrypt databases, backups, na logs at rest. -- Kama kawaida, Azure managed key hutumika kwa default lakini customer managed encryption key (CMEK) pia inaweza kutumika. +- Inaitwa “Transparent data encryption” na hufanya encryption ya databases, backups, na logs zinapokuwa hazitumiki. +- Kama kawaida, Azure managed key hutumiwa kwa default, lakini customer managed encryption key (CMEK) pia inaweza kutumika. **Managed Identities:** -- Inawezekana kugawa system na user managed MIs. -- Hutumika kupata encryption key (ikiwa CMEK inatumika) na services nyingine kutoka databases. -- Kwa baadhi ya examples za Azure services zinazoweza kuaccess kutoka database angalia [this page of the docs](https://learn.microsoft.com/en-us/sql/t-sql/statements/create-external-data-source-transact-sql) -- Ikiwa zaidi ya UMI moja imegawiwa, inawezekana kuonyesha default moja ya kutumia. +- Inawezekana ku-assign system na user managed MIs. +- Hutumiwa kufikia encryption key (ikiwa CMEK inatumika) na services nyingine kutoka kwenye databases. +- Kwa mifano ya Azure services zinazoweza kufikiwa kutoka kwenye database, angalia [this page of the docs](https://learn.microsoft.com/en-us/sql/t-sql/statements/create-external-data-source-transact-sql) +- Ikiwa UMI zaidi ya moja ime-assigniwa, inawezekana kubainisha ile ya default ya kutumia. - Inawezekana kusanidi federated client identity kwa cross-tenant access. -Some commands to access info inside a blob storage from a SQL database: +Baadhi ya commands za kufikia taarifa ndani ya blob storage kutoka kwenye SQL database: ```sql -- Create a credential for the managed identity CREATE DATABASE SCOPED CREDENTIAL [ManagedIdentityCredential] @@ -71,24 +71,24 @@ GO ``` **Microsoft Defender:** -- Inafaa kwa “mitigating potential database vulnerabilities, and detecting anomalous activities” -- Tutazungumza kuhusu Defender katika somo lake lenyewe (inaweza kuwashwa katika huduma nyingine kadhaa za Azure) +- Inafaa kwa “kupunguza udhaifu unaoweza kutokea wa database, na kugundua shughuli zisizo za kawaida” +- Tutazungumzia Defender katika lesson yake yenyewe (inaweza kuwezeshwa katika Azure services nyingine kadhaa) **Backups:** -- Marudio ya backup yanadhibitiwa katika retention policies. +- Frequency ya Backup inadhibitiwa katika retention policies. **Deleted databases:** -- Inawezekana kurestore DBs ambazo zimefutwa kutoka kwenye existing backups. +- Inawezekana kurestore DBs zilizofutwa kutoka kwenye backups zilizopo. ## Azure SQL Database -**Azure SQL Database** ni **fully managed database platform as a service (PaaS)** inayotoa scalable na secure relational database solutions. Imejengwa juu ya teknolojia za hivi karibuni za SQL Server na huondoa hitaji la usimamizi wa infrastructure, na kuifanya kuwa chaguo maarufu kwa cloud-based applications. +**Azure SQL Database** ni **fully managed database platform as a service (PaaS)** inayotoa suluhisho za relational database zinazoweza kupanuka na zilizo salama. Imejengwa kwenye teknolojia za hivi karibuni za SQL Server na huondoa hitaji la kusimamia infrastructure, jambo linaloifanya iwe chaguo maarufu kwa cloud-based applications. -Ili kuunda SQL database inahitajika kuonyesha SQL server itakapohostiwa. +Ili kuunda SQL database, ni muhimu kuonyesha SQL server ambayo itakuwa mwenyeji wake. ### SQL Database Security Features -- **Always Up-to-Date**: Huendesha kwenye latest stable version ya SQL Server na hupokea features na patches mpya kiotomati. +- **Always Up-to-Date**: Huendesha toleo thabiti la hivi karibuni la SQL Server na hupokea features na patches mpya automatically. - **Inherited SQL Server security features:** - Authentication (SQL and/or Entra ID) - Assigned Managed Identities @@ -97,32 +97,32 @@ Ili kuunda SQL database inahitajika kuonyesha SQL server itakapohostiwa. - Backups - … - **Data redundancy:** Chaguo ni local, zone, Geo au Geo-Zone redundant. -- **Ledger:** Huthibitisha kwa cryptography integrity ya data, kuhakikisha kuwa tampering yoyote hugunduliwa. Inafaa kwa taasisi za kifedha, matibabu na kila organization inayosimamia sensitive data. +- **Ledger:** Huthibitisha integrity ya data kwa njia ya cryptographic, na kuhakikisha kuwa tampering yoyote inagunduliwa. Ni muhimu kwa mashirika ya kifedha, kimatibabu na shirika lolote linalosimamia data nyeti. -SQL database inaweza kuwa sehemu ya **elastic Pool**. Elastic pools ni suluhisho la gharama nafuu kwa kusimamia databases nyingi kwa kushiriki configurable compute (eDTUs) na storage resources kati yao, huku pricing ikitegemea tu resources zilizotengwa badala ya idadi ya databases. +SQL database inaweza kuwa sehemu ya **elastic Pool**. Elastic pools ni suluhisho la gharama nafuu la kusimamia databases nyingi kwa kushirikisha compute (eDTUs) na storage resources zinazoweza kusanidiwa, huku bei ikitegemea resources zilizotengwa badala ya idadi ya databases. #### Azure SQL Column Level Security (Masking) & Row Level Security -**Azure SQL's dynamic** data masking ni feature inayosaidia **kulinda sensitive information kwa kuificha** kutoka kwa unauthorized users. Badala ya kubadili actual data, hu-masking data inayoonyeshwa ki-dynamic, kuhakikisha kuwa details nyeti kama credit card numbers zinafichwa. +**Azure SQL's dynamic** data masking ni feature inayosaidia **kulinda taarifa nyeti kwa kuzificha** dhidi ya users wasio na authorization. Badala ya kubadilisha data halisi, hufanya masking ya data inayoonyeshwa dynamically, na kuhakikisha kuwa maelezo nyeti kama namba za credit card yanafichwa. -**Dynamic Data Masking** huathiri watumiaji wote isipokuwa wale ambao hawaja-maskwa (watumiaji hawa wanahitaji kuonyeshwa) na administrators. Ina chaguo la configuration linalobainisha ni SQL users gani wameondolewa kwenye dynamic data masking, huku **administrators kila mara wakitengwa**. +**Dynamic Data Masking** inaathiri users wote isipokuwa wale ambao hawafanyiwi masking (users hawa wanahitaji kuonyeshwa) na administrators. Ina configuration option inayobainisha ni SQL users gani wameondolewa kwenye dynamic data masking, huku **administrators wakitengwa kila wakati**. -**Azure SQL Row Level Security (RLS)** ni feature inayodhibiti ni rows zipi user anaweza kuona au kurekebisha, kuhakikisha kila user anaona tu data inayomhusu. Kwa kuunda security policies zenye filter au block predicates, organizations zinaweza kutekeleza fine-grained access kwenye database level. +**Azure SQL Row Level Security (RLS)** ni feature inayodhibiti **ni rows zipi user anaweza kuona au kurekebisha**, na kuhakikisha kila user anaona tu data inayomhusu. Kwa kuunda security policies zenye filter au block predicates, mashirika yanaweza kutekeleza fine-grained access katika kiwango cha database. ### Azure SQL Managed Instance -**Azure SQL Managed Instances** ni kwa larger scale, entire SQL Server instance-scoped deployments. Hutoa karibu 100% compatibility na latest SQL Server on-premises (Enterprise Edition) Database Engine, ambayo hutoa native virtual network (VNet) implementation inayoshughulikia common security concerns, na business model inayofaa kwa on-premises SQL Server customers. +**Azure SQL Managed Instances** ni kwa deployments za kiwango kikubwa, zinazohusu instance nzima ya SQL Server. Hutoa compatibility ya karibu 100% na Database Engine ya SQL Server on-premises ya hivi karibuni (Enterprise Edition), ambayo hutoa native virtual network (VNet) implementation inayoshughulikia security concerns za kawaida, pamoja na business model inayowafaa wateja wa SQL Server on-premises. ### Azure SQL Virtual Machines -**Azure SQL Virtual Machines** inaruhusu **kudhibiti operating system** na SQL Server instance, kwani VM itaundwa katika VM service inayoendesha SQL server. +**Azure SQL Virtual Machines** huruhusu **kudhibiti operating system** na SQL Server instance, kwa kuwa VM itaspawn katika VM service inayoendesha SQL server. -Wakati SQL Virtual Machine inapoundwa inawezekana **kuchagua settings zote za VM** (kama ilivyoonyeshwa katika somo la VM) ambazo zitahost SQL server. -- Hii inamaanisha kuwa VM itakuwa inafikia baadhi ya VNet(s), inaweza kuwa na **Managed Identities attached** kwake, inaweza kuwa na file shares mounted… jambo linalofanya **pivoting kutoka SQL** kwenda VM kuwa la kuvutia sana. -- Zaidi ya hayo, inawezekana kusanidi app id na secret ili **kuruhusu SQL kufikia specific key vault**, ambayo inaweza kuwa na sensitive info. +Wakati SQL Virtual Machine inapoundwa, inawezekana **kuchagua settings zote za VM** (kama ilivyoonyeshwa katika VM lesson) ambayo itakuwa mwenyeji wa SQL server. +- Hii inamaanisha kuwa VM itakuwa ikifikia VNet(s) fulani, inaweza kuwa na **Managed Identities attached** kwayo, inaweza kuwa na file shares zilizomountiwa… na hivyo kufanya **pivoting kutoka SQL** kwenda kwenye VM kuwa ya kuvutia sana. +- Zaidi ya hayo, inawezekana kusanidi app id na secret ili **kuruhusu SQL kufikia key vault maalum**, ambayo inaweza kuwa na taarifa nyeti. -Pia inawezekana kusanidi mambo kama **automatic SQL updates**, **automatic backups**, **Entra ID authentication** na features nyingi za huduma nyingine za SQL. +Pia inawezekana kusanidi vitu kama **automatic SQL updates**, **automatic backups**, **Entra ID authentication** na features nyingi za SQL services nyingine. ## Enumeration @@ -261,7 +261,7 @@ Get-AzSqlVM {{#endtab}} {{#endtabs}} -Zaidi, ikiwa unataka kuorodhesha Dynamic Data Masking, na Row Level policies, ndani ya database, unaweza kuuliza: +Zaidi ya hayo, ikiwa unataka kuorodhesha Dynamic Data Masking na Row Level policies ndani ya database, unaweza kuendesha query: ```sql --Enumerates the masked columns SELECT @@ -286,9 +286,9 @@ JOIN sys.security_predicates AS sp2 ON sp.object_id = sp2.object_id; ``` -### Unganisha na endesha SQL queries +### Unganisha na utekeleze SQL queries -Unaweza kupata connection string (inayojumuisha credentials) kutoka mfano [enumerating an Az WebApp](az-app-services.md): +Unaweza kupata connection string (inayojumuisha credentials) kutoka kwenye mfano wa [enumerating an Az WebApp](az-app-services.md): ```bash function invoke-sql{ param($query) @@ -307,11 +307,11 @@ $Connection.Close() invoke-sql 'Select Distinct TABLE_NAME From information_schema.TABLES;' ``` -Unaweza pia kutumia sqlcmd kufikia database. Ni muhimu kujua kama server inaruhusu public connections `az sql server show --name --resource-group `, na pia kama firewall rule inaruhusu IP yetu kufikia: +Unaweza pia kutumia sqlcmd kufikia hifadhidata. Ni muhimu kujua ikiwa server inaruhusu miunganisho ya umma `az sql server show --name --resource-group `, na pia ikiwa sheria ya firewall inaruhusu IP yetu kufikia: ```bash sqlcmd -S .database.windows.net -U -P -d ``` -## Marejeo +## Marejeleo - [https://learn.microsoft.com/en-us/azure/azure-sql/azure-sql-iaas-vs-paas-what-is-overview?view=azuresql](https://learn.microsoft.com/en-us/azure/azure-sql/azure-sql-iaas-vs-paas-what-is-overview?view=azuresql) - [https://learn.microsoft.com/en-us/azure/azure-sql/database/single-database-overview?view=azuresql](https://learn.microsoft.com/en-us/azure/azure-sql/database/single-database-overview?view=azuresql) diff --git a/src/pentesting-cloud/azure-security/az-services/az-storage.md b/src/pentesting-cloud/azure-security/az-services/az-storage.md index 20dae9bf7..bdd66f882 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-storage.md +++ b/src/pentesting-cloud/azure-security/az-services/az-storage.md @@ -1,55 +1,55 @@ -# Az - Storage Accounts & Blobs +# Az - Akaunti za Storage na Blobs {{#include ../../../banners/hacktricks-training.md}} ## Taarifa za Msingi -Azure Storage Accounts ni huduma za msingi katika Microsoft Azure zinazotoa cloud **storage inayoweza kupanuka, salama, na yenye upatikanaji wa juu kwa aina mbalimbali za data**, ikijumuisha blobs (binary large objects), files, queues, na tables. Hufanya kazi kama containers zinazokusanya huduma hizi tofauti za storage pamoja chini ya namespace moja kwa usimamizi rahisi. +Azure Storage Accounts ni huduma za msingi katika Microsoft Azure zinazotoa **storage ya cloud inayoweza kupanuka, salama na inayopatikana kwa kiwango cha juu kwa aina mbalimbali za data**, ikijumuisha blobs (binary large objects), files, queues na tables. Zinafanya kazi kama containers zinazokusanya huduma hizi tofauti za storage pamoja chini ya namespace moja kwa ajili ya usimamizi rahisi. -**Main configuration options**: +**Chaguo kuu za usanidi**: -- Kila storage account lazima iwe na **uniq name across all Azure**. -- Kila storage account huwekwa kwenye **region** au kwenye Azure extended zone +- Kila storage account lazima iwe na **jina la kipekee katika Azure yote**. +- Kila storage account hu-deployiwa katika **region** au Azure extended zone - Inawezekana kuchagua toleo la **premium** la storage account kwa performance bora -- Inawezekana kuchagua kati ya **4 types of redundancy to protect** dhidi ya rack, drive na datacenter **failures**. +- Inawezekana kuchagua kati ya **aina 4 za redundancy za kulinda** dhidi ya **failures** za rack, drive na datacenter. -**Security configuration options**: +**Chaguo za usanidi wa usalama**: -- **Require secure transfer for REST API operations**: Hitaji TLS katika mawasiliano yoyote na storage -- **Allows enabling anonymous access on individual containers**: La sivyo, haitakuwa possible kuwezesha anonymous access baadaye -- **Enable storage account key access**: La sivyo, access kwa kutumia Shared Keys itakuwa marufuku +- **Require secure transfer for REST API operations**: Inahitaji TLS katika mawasiliano yoyote na storage +- **Allows enabling anonymous access on individual containers**: Ikiwa haijawezeshwa, haitawezekana kuwezesha anonymous access baadaye +- **Enable storage account key access**: Ikiwa haijawezeshwa, access kwa kutumia Shared Keys itazuiwa - **Minimum TLS version** -- **Permitted scope for copy operations**: Ruhusu kutoka kwa storage account yoyote, kutoka kwa storage account yoyote iliyo kwenye Entra tenant moja au kutoka kwa storage account yenye private endpoints ndani ya virtual network moja. +- **Permitted scope for copy operations**: Inaruhusu kutoka storage account yoyote, storage account yoyote kutoka Entra tenant hiyo hiyo, au storage account zilizo na private endpoints katika virtual network hiyo hiyo. -**Blob Storage options**: +**Chaguo za Blob Storage**: - **Allow cross-tenant replication** -- **Access tier**: Hot (data inayofikiwa mara kwa mara), Cool na Cold (data inayofikiwa mara chache) +- **Access tier**: Hot (data inayofikiwa mara kwa mara), Cool na Cold (data isiyofikiwa mara kwa mara) -**Networking options**: +**Chaguo za networking**: - **Network access**: -- Ruhusu kutoka kwa networks zote -- Ruhusu kutoka kwa virtual networks na IP addresses zilizochaguliwa -- Zima public access na tumia private access -- **Private endpoints**: Inaruhusu connection ya private kwenda storage account kutoka kwenye virtual network +- Ruhusu kutoka networks zote +- Ruhusu kutoka virtual networks na IP addresses zilizochaguliwa +- Zima public access na utumie private access +- **Private endpoints**: Inaruhusu connection ya private kwenda kwenye storage account kutoka virtual network -**Data protection options**: +**Chaguo za ulinzi wa data**: -- **Point-in-time restore for containers**: Huruhusu kurejesha containers kwenda hali ya awali -- Inahitaji versioning, change feed, na blob soft delete ziwe zimewezeshwa. -- **Enable soft delete for blobs**: Inawezesha retention period kwa siku kwa blobs zilizofutwa (hata zile zilizowekewa overwrite) -- **Enable soft delete for containers**: Inawezesha retention period kwa siku kwa containers zilizofutwa -- **Enable soft delete for file shares**: Inawezesha retention period kwa siku kwa file shared zilizofutwa -- **Enable versioning for blobs**: Dumisha versions za awali za blobs zako -- **Enable blob change feed**: Hifadhi logs za create, modification, na delete changes kwa blobs -- **Enable version-level immutability support**: Hukuruhusu kuweka time-based retention policy kwenye account-level ambayo itatumika kwa blob versions zote. +- **Point-in-time restore for containers**: Inaruhusu kurejesha containers katika hali ya awali +- Inahitaji versioning, change feed na blob soft delete kuwezeshwa. +- **Enable soft delete for blobs**: Huwezesha retention period ya siku kwa blobs zilizofutwa (hata zilizofanyiwa overwrite) +- **Enable soft delete for containers**: Huwezesha retention period ya siku kwa containers zilizofutwa +- **Enable soft delete for file shares**: Huwezesha retention period ya siku kwa file shares zilizofutwa +- **Enable versioning for blobs**: Huhifadhi versions za awali za blobs zako +- **Enable blob change feed**: Huhifadhi logs za mabadiliko ya kuunda, kurekebisha na kufuta blobs +- **Enable version-level immutability support**: Inaruhusu kuweka time-based retention policy katika kiwango cha account ambayo itatumika kwa blob versions zote. - Version-level immutability support na point-in-time restore for containers haziwezi kuwezeshwa kwa wakati mmoja. -**Encryption configuration options**: +**Chaguo za usanidi wa encryption**: - **Encryption type**: Inawezekana kutumia Microsoft-managed keys (MMK) au Customer-managed keys (CMK) -- **Enable infrastructure encryption**: Huruhusu double encrypt the data "for more security" +- **Enable infrastructure encryption**: Inaruhusu ku-encrypt data mara mbili "kwa usalama zaidi" ### Storage endpoints @@ -64,18 +64,18 @@ Azure Storage Accounts ni huduma za msingi katika Microsoft Azure zinazotoa clou ### Public Exposure -Kama "Allow Blob public access" imewashwa (**enabled**; imezimwa kwa default), wakati wa kuunda container inawezekana: +Ikiwa "Allow Blob public access" **imewezeshwa** (imezimwa kwa default), wakati wa kuunda container inawezekana: -- Kutoa **public access to read blobs** (unahitaji kujua jina). -- **List container blobs** na **read** them. -- Kuuweka kuwa **private** kabisa +- Kutoa **public access ya kusoma blobs** (unahitaji kujua jina). +- **Kuorodhesha blobs za container** na **kuzisoma**. +- Kuifanya iwe **private** kabisa
### Static website (`$web`) exposure & leaked secrets -- **Static websites** hutolewa kutoka kwa special `$web` container kupitia region-specific endpoint kama `https://.z13.web.core.windows.net/`. -- `$web` container inaweza kuripoti `publicAccess: null` kupitia blob API, lakini files bado zinaweza kufikiwa kupitia static site endpoint, hivyo kuweka config/IaC artifacts hapo kunaweza leak secrets. +- **Static websites** hutolewa kutoka kwenye container maalum ya `$web` kupitia endpoint maalum ya region kama vile `https://.z13.web.core.windows.net/`. +- Container ya `$web` inaweza kuripoti `publicAccess: null` kupitia blob API, lakini files bado zinaweza kufikiwa kupitia static site endpoint, hivyo kuweka config/IaC artifacts humo kunaweza ku-leak secrets. - Quick audit workflow: ```bash # Identify storage accounts with static website hosting enabled @@ -87,53 +87,53 @@ az storage blob list --container-name '$web' --account-name --auth-mo # Pull suspicious files directly (e.g., IaC tfvars containing secrets/SAS) az storage blob download -c '$web' --name iac/terraform.tfvars --file /dev/stdout --account-name --auth-mode login ``` -### Kukagua ufichuzi wa anonymous blob +### Kukagua exposure ya blob bila uthibitishaji -- **Tafuta storage accounts** ambazo zinaweza kufichua data: `az storage account list | jq -r '.[] | select(.properties.allowBlobPublicAccess==true) | .name'`. Ikiwa `allowBlobPublicAccess` ni `false` huwezi kufanya containers ziwe public. -- **Kagua accounts hatarishi** ili kuthibitisha flag na settings nyingine dhaifu: `az storage account show --name --query '{allow:properties.allowBlobPublicAccess, minTls:properties.minimumTlsVersion}'`. -- **Hesabu container-level exposure** ambapo flag imewezeshwa: +- **Tambua storage accounts** zinazoweza kufichua data: `az storage account list | jq -r '.[] | select(.properties.allowBlobPublicAccess==true) | .name'`. Ikiwa `allowBlobPublicAccess` ni `false`, huwezi kuweka containers ziwe public. +- **Kagua accounts zilizo hatarini** ili kuthibitisha flag na mipangilio mingine dhaifu: `az storage account show --name --query '{allow:properties.allowBlobPublicAccess, minTls:properties.minimumTlsVersion}'`. +- **Orodhesha exposure ya kiwango cha container** ambapo flag imewezeshwa: ```bash az storage container list --account-name \ --query '[].{name:name, access:properties.publicAccess}' ``` -- `"Blob"`: anonima kusoma kunaruhusiwa **tu wakati jina la blob linajulikana** (hakuna listing). +- `"Blob"`: anonymous reads zinaruhusiwa **pale tu jina la blob linapojulikana** (hakuna listing). - `"Container"`: anonymous **list + read** ya kila blob. - `null`: private; authentication inahitajika. - **Thibitisha access** bila credentials: -- Iwapo `publicAccess` ni `Container`, anonymous listing inafanya kazi: `curl "https://.blob.core.windows.net/?restype=container&comp=list"`. -- Kwa `Blob` na `Container` zote mbili, anonymous blob download inafanya kazi wakati jina linajulikana: +- Ikiwa `publicAccess` ni `Container`, anonymous listing inafanya kazi: `curl "https://.blob.core.windows.net/?restype=container&comp=list"`. +- Kwa `Blob` na `Container`, anonymous blob download inafanya kazi jina linapojulikana: ```bash az storage blob download -c -n --account-name --file /dev/stdout # or via raw HTTP curl "https://.blob.core.windows.net//" ``` -### Connect to Storage +### Unganisha kwenye Storage -If you find any **storage** you can connect to you could use the tool [**Microsoft Azure Storage Explorer**](https://azure.microsoft.com/es-es/products/storage/storage-explorer/) to do so. +Ukigundua **storage** yoyote unayoweza kuunganisha, unaweza kutumia tool ya [**Microsoft Azure Storage Explorer**](https://azure.microsoft.com/es-es/products/storage/storage-explorer/) kufanya hivyo. -## Access to Storage +## Ufikiaji wa Storage ### RBAC -Ni inawezekana kutumia Entra ID principals na **RBAC roles** kufikia storage accounts na ndio njia inayopendekezwa. +Inawezekana kutumia principals za Entra ID zenye **RBAC roles** kufikia storage accounts, na hii ndiyo njia inayopendekezwa. ### Access Keys -The storage accounts have access keys that can be used to access it. Hii inatoa f**ull access to the storage account.** +Storage accounts zina access keys zinazoweza kutumika kuifikia. Hii hutoa ufikiaji wa k**utosha kwenye storage account.**
### **Shared Keys & Lite Shared Keys** -Ni inawezekana [**generate Shared Keys**](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key) zilizosainiwa kwa kutumia access keys ili ku-authorize access to certain resources kupitia signed URL. +Inawezekana [**generate Shared Keys**](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key) zilizosainiwa kwa access keys ili kuidhinisha ufikiaji wa resources fulani kupitia signed URL. > [!NOTE] -> Kumbuka kuwa sehemu ya `CanonicalizedResource` inawakilisha storage services resource (URI). Na kama sehemu yoyote katika URL ime-encode, inapaswa pia ku-encode ndani ya `CanonicalizedResource`. +> Kumbuka kuwa sehemu ya `CanonicalizedResource` inawakilisha resource ya storage services (URI). Na ikiwa sehemu yoyote kwenye URL ime-encode, inapaswa pia ku-encode ndani ya `CanonicalizedResource`. > [!NOTE] -> Hii hutumiwa **kwa default na `az` cli** kuthibitisha requests. Ili ifanye kazi kwa kutumia Entra ID principal credentials onyesha param `--auth-mode login`. +> Hii **hutumiwa kwa default na `az` cli** kuthibitisha requests. Ili itumie credentials za Entra ID principal, weka param `--auth-mode login`. -- Ni inawezekana generate **shared key for blob, queue and file services** kwa kusaini taarifa zifuatazo: +- Inawezekana kutengeneza **shared key kwa blob, queue na file services** kwa kusaini taarifa ifuatayo: ```bash StringToSign = VERB + "\n" + Content-Encoding + "\n" + @@ -150,7 +150,7 @@ Range + "\n" + CanonicalizedHeaders + CanonicalizedResource; ``` -- Inawezekana kuzalisha **shared key for table services** kwa kusaini taarifa ifuatayo: +- Inawezekana kutengeneza **shared key for table services** kwa kusaini taarifa ifuatayo: ```bash StringToSign = VERB + "\n" + Content-MD5 + "\n" + @@ -158,7 +158,7 @@ Content-Type + "\n" + Date + "\n" + CanonicalizedResource; ``` -- Inawezekana kuzalisha **lite shared key kwa blob, queue na file services** kwa kusaini taarifa zifuatazo: +- Inawezekana kutengeneza **lite shared key ya blob, queue na file services** kwa kusaini taarifa ifuatayo: ```bash StringToSign = VERB + "\n" + Content-MD5 + "\n" + @@ -167,12 +167,12 @@ Date + "\n" + CanonicalizedHeaders + CanonicalizedResource; ``` -- Inawezekana kuzalisha **lite shared key for table services** kwa kusaini taarifa ifuatayo: +- Inawezekana kutengeneza **lite shared key for table services** kwa kusaini maelezo yafuatayo: ```bash StringToSign = Date + "\n" CanonicalizedResource ``` -Kisha, ili kutumia key, inaweza kufanywa katika Authorization header kufuatia syntax: +Kisha, ili kutumia key, inaweza kuwekwa katika kichwa cha Authorization kwa kufuata syntax: ```bash Authorization="[SharedKey|SharedKeyLite] :" #e.g. @@ -186,68 +186,68 @@ Content-Length: 0 ``` ### **Shared Access Signature** (SAS) -Shared Access Signatures (SAS) ni secure, time-limited URLs ambazo **grant specific permissions to access resource**s katika Azure Storage account bila kufichua account's access keys. Wakati access keys zinatoa full administrative access kwa resources zote, SAS huruhusu granular control kwa kubainisha permissions (kama read au write) na kufafanua expiration time. +Shared Access Signatures (SAS) ni URL salama zenye muda maalum ambazo **zinatoa ruhusa maalum za kufikia rasilimali** katika Azure Storage account bila kufichua access keys za account. Ingawa access keys hutoa ufikiaji kamili wa kiutawala kwa rasilimali zote, SAS huruhusu udhibiti wa kina kwa kubainisha ruhusa (kama vile kusoma au kuandika) na kuweka muda wa kuisha. -#### SAS Types +#### Aina za SAS -- **User delegation SAS**: Hii inatengenezwa kutoka kwa **Entra ID principal** ambayo itasaini SAS na ku-delegate permissions kutoka kwa user kwenda kwa SAS. Inaweza kutumika tu na **blob and data lake storage** ([docs](https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas)). Inawezekana **revoke** zote generated user delegated SAS. -- Hata kama inawezekana kutengeneza delegation SAS yenye permissions “zaidi” kuliko zile ambazo user anazo. Hata hivyo, ikiwa principal hana hizo permissions, haitafanya kazi (no privesc). -- **Service SAS**: Hii inasainiwa kwa kutumia moja ya storage account **access keys**. Inaweza kutumika kutoa access kwa specific resources katika single storage service. Ikiwa key itanyweshwa upya, SAS itaacha kufanya kazi. -- **Account SAS**: Pia inasainiwa na moja ya storage account **access keys**. Inatoa access kwa resources katika storage account services (Blob, Queue, Table, File) na inaweza kujumuisha service-level operations. +- **User delegation SAS**: Hii huundwa kutoka kwa **Entra ID principal** ambayo itatia sahihi SAS na kukabidhi ruhusa kutoka kwa user kwenda kwa SAS. Inaweza kutumiwa tu na **blob and data lake storage** ([docs](https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas)). Inawezekana **kufuta** user delegated SAS zote zilizoundwa. +- Hata kama inawezekana kutengeneza delegation SAS yenye ruhusa "nyingi" kuliko zile ambazo user anazo. Hata hivyo, ikiwa principal haina ruhusa hizo, haitafanya kazi (hakuna privesc). +- **Service SAS**: Hii hutia sahihi kwa kutumia mojawapo ya **access keys** za storage account. Inaweza kutumiwa kutoa ufikiaji kwa rasilimali maalum katika storage service moja. Key ikifanywa upya, SAS itaacha kufanya kazi. +- **Account SAS**: Hii pia hutia sahihi kwa kutumia mojawapo ya **access keys** za storage account. Inatoa ufikiaji kwa rasilimali katika services za storage account (Blob, Queue, Table, File) na inaweza kujumuisha operations za kiwango cha service. -A SAS URL signed by an **access key** looks like this: +URL ya SAS iliyotiwa sahihi na **access key** inaonekana hivi: - `https://.blob.core.windows.net/newcontainer?sp=r&st=2021-09-26T18:15:21Z&se=2021-10-27T02:14:21Z&spr=https&sv=2021-07-08&sr=c&sig=7S%2BZySOgy4aA3Dk0V1cJyTSIf1cW%2Fu3WFkhHV32%2B4PE%3D` -A SAS URL signed as a **user delegation** looks like this: +URL ya SAS iliyotiwa sahihi kama **user delegation** inaonekana hivi: - `https://.blob.core.windows.net/testing-container?sp=r&st=2024-11-22T15:07:40Z&se=2024-11-22T23:07:40Z&skoid=d77c71a1-96e7-483d-bd51-bd753aa66e62&sktid=fdd066e1-ee37-49bc-b08f-d0e152119b04&skt=2024-11-22T15:07:40Z&ske=2024-11-22T23:07:40Z&sks=b&skv=2022-11-02&spr=https&sv=2022-11-02&sr=c&sig=7s5dJyeE6klUNRulUj9TNL0tMj2K7mtxyRc97xbYDqs%3D` -Note some **http params**: +Zingatia baadhi ya **http params**: -- The **`se`** param indicates the **expiration date** of the SAS -- The **`sp`** param indicates the **permissions** of the SAS -- The **`sig`** is the **signature** validating the SAS +- Param ya **`se`** inaonyesha **tarehe ya kuisha** ya SAS +- Param ya **`sp`** inaonyesha **ruhusa** za SAS +- **`sig`** ni **signature** inayothibitisha SAS -#### SAS permissions +#### Ruhusa za SAS -When generating a SAS it's needed to indicate the permissions that it should be granting. Depending on the objet the SAS is being generated over different permissions might be included. For example: +Wakati wa kutengeneza SAS, ni muhimu kuonyesha ruhusa ambazo inapaswa kutoa. Kulingana na object ambayo SAS inatengenezwa, ruhusa tofauti zinaweza kujumuishwa. Kwa mfano: - (a)dd, (c)reate, (d)elete, (e)xecute, (f)ilter_by_tags, (i)set_immutability_policy, (l)ist, (m)ove, (r)ead, (t)ag, (w)rite, (x)delete_previous_version, (y)permanent_delete -## SFTP Support for Azure Blob Storage +## Usaidizi wa SFTP kwa Azure Blob Storage -Azure Blob Storage sasa inasaidia SSH File Transfer Protocol (SFTP), ikiruhusu secure file transfer na management moja kwa moja kwenda Blob Storage bila kuhitaji custom solutions au third-party products. +Azure Blob Storage sasa inasaidia SSH File Transfer Protocol (SFTP), ikiwezesha kuhamisha na kudhibiti mafaili kwa usalama moja kwa moja kwenye Blob Storage bila kuhitaji solutions maalum au bidhaa za third-party. -### Key Features +### Vipengele Muhimu -- Protocol Support: SFTP inafanya kazi na Blob Storage accounts zilizo configured with hierarchical namespace (HNS). Hii hupanga blobs ndani ya directories na subdirectories kwa urahisi wa navigation. -- Security: SFTP inaweza kutumia local user identities, lakini pia inasaidia Microsoft Entra ID-based access with Azure RBAC kwa authorization. Hii ina maana access inaweza kutolewa kwa kawaida Blob Storage data-plane roles badala ya kuunda local SFTP users. Local users wanaweza authenticate kupitia: -- Azure-generated passwords +- Protocol Support: SFTP hufanya kazi na Blob Storage accounts zilizosanidiwa kwa hierarchical namespace (HNS). Hii hupanga blobs katika directories na subdirectories kwa urambazaji rahisi. +- Security: SFTP inaweza kutumia local user identities, lakini pia inasaidia ufikiaji unaotegemea Microsoft Entra ID pamoja na Azure RBAC kwa authorization. Hii inamaanisha kuwa ufikiaji unaweza kutolewa kwa kutumia Blob Storage data-plane roles za kawaida badala ya kuunda local SFTP users. Local users wanaweza ku-authenticate kupitia: +- Passwords zinazotengenezwa na Azure - Public-private SSH key pairs -- Granular Permissions: Permissions kama Read, Write, Delete, na List zinaweza kupewa local users kwa hadi containers 100. -- Networking Considerations: SFTP connections hufanywa kupitia port 22. Azure inasaidia network configurations kama firewalls, private endpoints, au virtual networks ili kulinda SFTP traffic. +- Granular Permissions: Ruhusa kama Read, Write, Delete na List zinaweza kukabidhiwa local users kwa hadi containers 100. +- Networking Considerations: Miunganisho ya SFTP hufanywa kupitia port 22. Azure inasaidia network configurations kama firewalls, private endpoints au virtual networks ili kulinda SFTP traffic. -### Setup Requirements +### Mahitaji ya Usanidi -- Hierarchical Namespace: HNS lazima iwe enabled wakati wa kuunda storage account. -- Supported Encryption: Inahitaji Microsoft Security Development Lifecycle (SDL)-approved cryptographic algorithms (e.g., rsa-sha2-256, ecdsa-sha2-nistp256). +- Hierarchical Namespace: HNS lazima iwe imewezeshwa wakati wa kuunda storage account. +- Supported Encryption: Inahitaji cryptographic algorithms zilizoidhinishwa na Microsoft Security Development Lifecycle (SDL) (kwa mfano, rsa-sha2-256, ecdsa-sha2-nistp256). - SFTP Configuration: -- Enable SFTP on the storage account. -- Kwa local-user access, create local user identities with appropriate permissions. -- Kwa local users, configure home directories ili kufafanua starting location yao ndani ya container. +- Wezesha SFTP kwenye storage account. +- Kwa local-user access, unda local user identities zenye ruhusa zinazofaa. +- Kwa local users, sanidi home directories ili kubainisha eneo lao la kuanzia ndani ya container. -### Permissions +### Ruhusa | Permission | Symbol | Description | | ---------------------- | ------ | ------------------------------------ | -| **Read** | `r` | Read file content. | -| **Write** | `w` | Upload files and create directories. | -| **List** | `l` | List contents of directories. | -| **Delete** | `d` | Delete files or directories. | -| **Create** | `c` | Create files or directories. | -| **Modify Ownership** | `o` | Change the owning user or group. | -| **Modify Permissions** | `p` | Change ACLs on files or directories. | +| **Read** | `r` | Soma maudhui ya file. | +| **Write** | `w` | Upload files na unda directories. | +| **List** | `l` | Orodhesha yaliyomo kwenye directories. | +| **Delete** | `d` | Futa files au directories. | +| **Create** | `c` | Unda files au directories. | +| **Modify Ownership** | `o` | Badilisha user au group anayemiliki. | +| **Modify Permissions** | `p` | Badilisha ACLs kwenye files au directories. | ## Enumeration @@ -379,7 +379,7 @@ az storage account local-user list \ {{#tab name="Az PowerShell" }}
-Az PowerShell enumeration +Enumeration ya Az PowerShell ```powershell # Get storage accounts Get-AzStorageAccount | fl @@ -448,7 +448,7 @@ New-AzStorageBlobSASToken ` az-file-shares.md {{#endref}} -## Uongezaji wa Ruhusa +## Kuongeza Privilege {{#ref}} ../az-privilege-escalation/az-storage-privesc.md