Share via

Quickstart: Apply SSH Posture Control to a test machine

In the following steps, you will use Azure Policy to deploy SSH Posture Control settings to a test Linux VM.

For background and conceptual reference, see What is SSH Posture Control?.

For a more advanced walkthrough, see Manage your sshd settings using SSH Posture Control.

If you don't have an Azure account, you can create a free trial.

Caution

  • This Quickstart demonstrates applying a restrictive sshd configuration intended for a new disposable test machine. If you were to apply this configuration to other machines you could lock outself out. When trying out security controls such as SSH Posture Control, use an isolated sandbox environment such that even a mistake in policy assignment would not re-configure unintended machines.

Prerequisites

Before attempting the steps in this article, ensure that you already have:

  1. An Azure account where you have rights to create a resource group, policy assignments, and a virtual machine.
  2. Your preferred environment for interacting with Azure, such as:
    1. Azure Cloud Shell (recommended)
      1. Note: Examples will use bash mode. Readers may adapt examples to other shell environments including PowerShell.
    2. or your own shell environment with Azure CLI installed and signed in
    3. or Azure Portal in a web browser

Check that you are signed in to your test environment

  1. Use the account information in the portal to see your current context.

    Screen capture showing account information in Azure portal

Create a resource group

The choice of eastus location in this example is not significant. You can use any available Azure location.

Screen capture of creating resource group via portal

Assign the policy to the resource group

This Quickstart applies audit-and-configure behavior, using the built-in policy definition Configure SSH Posture Control on Linux machines.

The example assignment will rely largely on SSH Posture Control defaults (e.g., port 22, root access not allowed), with limited customization (banner text).

  1. Navigate to Policy, then Definitions
  2. Filter the list to find and select Configure SSH Posture Control on Linux machines
  3. From the policy definition page, click Assign
  4. In the policy assignment workflow
    1. Choose the new empty resource group (created earlier) as the scope.
    2. Optional: Choose a name for this policy assignment. By default the name of the policy definition is used.
    3. Optional: On the parameters tab, override a default value such as the "banner" value.
    4. Note: The rule 'port' should be configured with a single value to ensure proper functionality and compliance for auditing and configuring scenarios.
    5. Complete the creation of the policy assignment.

Caution

Whether you used the Portal or CLI, inspect the scope of the policy assignment you just created before proceeding. If the scope was mistakenly set to anything other than the new empty resource group created earlier, it should be corrected immediately to avoid configuing unintended machines.

Create a test VM and prepare it for Machine Configuration

  1. Create a Linux virtual machine
  2. Add a system assigned identity, if not already present
  3. Add the Machine Configuration extension (labeled in portal as Azure Machine Configuration for Linux)

Tip

In this Quickstart the pre-requisites for Machine Configuration (VM has managed identity and agent extension) were addressed directly during VM creation. At scale, these pre-requisites can be satisfied using the Deploy prerequisites to enable Guest Configuration policies on virtual machines built-in Policy Initiative.

Take a break before proceeding

Several steps will now happen automatically. Each of these steps can take a few minutes. Accordingly, please wait at least 15 minutes before proceeding.

Observe results

Using the following steps, you can see:

  1. How many machines are compliant (or not)
    1. Particularly useful at production scales, where you may have thousands of machines
  2. Which machines are compliant (or not)
  3. For a given machine, which individual rules are compliant (or not)

Optional: Add more test machines to experience scale

In this article the policy was assigned to a resource group which was initially empty and then gained one VM. While this demonstrates the system working end-to-end, it doesn't provide a sense of at-scale operations. For example, in the policy assignment compliance view a pie chart of one machine can feel artificial.

Consider adding more test machines to the resource group, whether manually or via automation. These could be Azure VMs or Arc-enabled machines. As you see those machines come into compliance (or even fail) you can gain a keener sense of operationalizing SSH Posture Control at scale.

Optional: Manually inspect test machine to confirm results

When getting started with a new feature such as SSH Posture Control, it can be valuable to manually inspect the results out of band. This helps to build confidence and clarity. The steps in this article, for example, should have resulted in a modified logon banner configuration on your test VM. You can confirm this by attempting an SSH connection to the machine to see the banner, or by inspecting the sshd_config file.

Clean up resources

To avoid ongoing charges, consider deleting the resource group used in this article. For example, the Azure CLI command would be az group delete --name "sshdemo01"

Related content