Azure instance using basic authentication

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: ansible-azure-azure-instance-using-basic-authentication

Provider: Azure

Platform: Ansible

Severity: Medium

Category: Best Practices

Learn More

Description

Linux virtual machines must require SSH key authentication instead of username/password. Password-based login is susceptible to brute-force attacks and credential compromise, which can lead to unauthorized access and lateral movement.

For Ansible azure_rm_virtualmachine resources, ensure ssh_password_enabled is set to false and linux_config.disable_password_authentication is set to true so only SSH key authentication is allowed. This rule applies to resources intended to be Linux VMs (where os_type is "linux" or unspecified). Resources missing these properties or that allow password authentication are flagged.

Secure example configuration:

- name: Create Linux VM with SSH keys only
  azure_rm_virtualmachine:
    name: my-linux-vm
    resource_group: my-rg
    os_type: Linux
    ssh_password_enabled: false
    linux_config:
      disable_password_authentication: true
    ssh_public_keys:
      - path: /home/azureuser/.ssh/authorized_keys
        key_data: "{{ lookup('file','~/.ssh/id_rsa.pub') }}"

Compliant Code Examples

---
- name: Create a VM with a custom image
  azure_rm_virtualmachine:
    resource_group: myResourceGroup
    name: testvm001
    vm_size: Standard_DS1_v2
    ssh_password_enabled: false
    ssh_public_keys:
      - path: ~/.ssh/id_rsa.pub
        key_data: somegeneratedkeydata
    image: customimage001
    os_type: Linux

Non-Compliant Code Examples

---
- name: Create a VM with a custom image
  azure_rm_virtualmachine:
    resource_group: myResourceGroup
    name: testvm001
    vm_size: Standard_DS1_v2
    admin_username: adminUser
    admin_password: password01
    image: customimage001
    os_type: Linux