VIEW RULE IN DATADOG

Description

A publicly accessible Azure VM instance with a privileged service principal has password-based SSH authentication enabled. Password-based SSH authentication increases the risk of brute-forcing usernames and passwords to gain access to the instance. Because the instance is publicly accessible and its attached service principal is privileged, a successful compromise could be leveraged to abuse those privileges and gain access to other resources in the environment.

Remediation

1. Identify the service principal attached to this instance.
2. Remove unnecessary privileges from the service principal. Consider using a role based on job function rather than a privileged role.
3. Review Create and manage SSH keys for authentication to a Linux VM in Azure for steps on creating and enabling SSH keys for authentication to compute instances. To transition from username and password authentication to SSH, you must deprovision the current VM and create an image of it with SSH as the authentication method. There is no way to transition directly.