> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit compute vms without ssh authentication remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Virtual Machines Should Only Allow SSH Based Authentication" for AZURE using AZURE console, follow these steps:

        1. Go to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)) and sign in with your credentials.
        2. Navigate to the Virtual Machines section.
        3. Select the virtual machine that needs to be remediated.
        4. Click on the "Networking" option from the left-hand side menu.
        5. Under the "Inbound port rules" section, remove the rule for RDP (Remote Desktop Protocol).
        6. Click on the "Add inbound port rule" button.
        7. Select "SSH" from the "Service" dropdown menu.
        8. Select "Any" or "IP Addresses" for the "Source" field, depending on your requirements.
        9. Click on the "Add" button to add the new rule.
        10. Save the changes by clicking on the "Save" button at the top of the page.

        After following these steps, the virtual machine will only allow SSH-based authentication, and the misconfiguration will be remediated.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Virtual Machines Should Only Allow SSH Based Authentication" for AZURE using AZURE CLI, please follow the below steps:

        1. Open Azure CLI on your local machine or use the Azure Cloud Shell.

        2. Run the following command to list all the virtual machines in your subscription:

           ```
           az vm list --query "[].{Name:name, ResourceGroup:resourceGroup}"
           ```

        3. Identify the virtual machine that you want to remediate and note down its name and resource group.

        4. Run the following command to update the network security group of the virtual machine to allow only SSH-based authentication:

           ```
           az vm update --name <vm-name> --resource-group <resource-group-name> --set "networkProfile.networkInterfaces[0].ipConfigurations[0].loadBalancerBackendAddressPools=[]" --no-wait
           ```

           Replace `<vm-name>` with the name of your virtual machine and `<resource-group-name>` with the name of the resource group it belongs to.

        5. This command will remove any load balancer backend address pools from the virtual machine's network interface, which will restrict access to only SSH-based authentication.

           Note: This command will not affect any other network security groups that the virtual machine may be associated with.

        6. Verify that the remediation is successful by checking the network security group of the virtual machine using the following command:

           ```
           az vm show -d --name <vm-name> --resource-group <resource-group-name> --query "networkProfile.networkInterfaces[0].ipConfigurations[0].loadBalancerBackendAddressPools"
           ```

           This command should return an empty array, indicating that there are no load balancer backend address pools associated with the virtual machine's network interface.

           Congratulations, you have successfully remediated the misconfiguration "Virtual Machines Should Only Allow SSH Based Authentication" for AZURE using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Virtual Machines Should Only Allow SSH Based Authentication" in Azure using Python, you can use the Azure Python SDK to update the Network Security Group (NSG) rules for the virtual machine. Here are the steps to follow:

        1. Install the Azure Python SDK using pip:

        ```
        pip install azure-mgmt-compute
        ```

        2. Authenticate to your Azure account using the Azure CLI or by setting environment variables for your Azure credentials.

        3. Get the NSG associated with the virtual machine:

        ```python theme={null}
        from azure.mgmt.network import NetworkManagementClient
        from azure.identity import AzureCliCredential

        credential = AzureCliCredential()
        network_client = NetworkManagementClient(credential, subscription_id)
        nsg_name = "my-nsg"
        nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)
        ```

        4. Update the NSG rules to only allow SSH traffic:

        ```python theme={null}
        from azure.mgmt.network.v2021_02_01.models import SecurityRuleProtocol, SecurityRuleAccess, SecurityRuleDirection, SecurityRule

        nsg.rules = [
            SecurityRule(
                name="SSH",
                protocol=SecurityRuleProtocol.tcp,
                source_address_prefix="*",
                destination_address_prefix="*",
                access=SecurityRuleAccess.allow,
                direction=SecurityRuleDirection.inbound,
                priority=100,
                source_port_range="*",
                destination_port_range="22"
            )
        ]
        nsg = network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)
        ```

        This code creates a new NSG rule that only allows inbound TCP traffic on port 22 (SSH) and deletes all other rules. The updated NSG is then created or updated in Azure.

        Note that this code assumes that the virtual machine is already configured to use SSH-based authentication. If not, you will need to configure SSH-based authentication on the virtual machine before updating the NSG rules.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_linux_virtual_machine" "VM_NAME" {
          name                = "VM_NAME"                       # replace with your VM name
          resource_group_name = azurerm_resource_group.RG_NAME.name
          location            = azurerm_resource_group.RG_NAME.location
          size                = "VM_SIZE"                       # e.g. "Standard_B2s"
          network_interface_ids = [
            azurerm_network_interface.NIC_NAME.id,
          ]

          # Ensure no admin_password is set on this resource.
          admin_username = "ADMIN_USERNAME"                     # replace with your SSH username

          disable_password_authentication = true                # SSH keys only (no password login)

          admin_ssh_key {
            username   = "ADMIN_USERNAME"                       # must match admin_username
            public_key = file("PATH_TO_PUBLIC_KEY")             # e.g. "~/.ssh/id_rsa.pub"
          }

          os_disk {
            name                 = "OS_DISK_NAME"
            caching              = "ReadWrite"
            storage_account_type = "Standard_LRS"
          }

          source_image_reference {
            publisher = "Canonical"
            offer     = "0001-com-ubuntu-server-focal"
            sku       = "20_04-lts-gen2"
            version   = "latest"
          }
        }
        ```

        Changing an existing VM from password-based to SSH-key-only (`disable_password_authentication = true` and removing `admin_password`) forces replacement of the `azurerm_linux_virtual_machine` resource, which will recreate the VM and can cause downtime.

        To verify, `terraform plan` should show:

        * `disable_password_authentication` changing from `false` to `true`.
        * Removal of any `admin_password` argument.
        * A replacement (`-/+`) planned for the `azurerm_linux_virtual_machine.VM_NAME` resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>