Check ID: vm_linux_enforce_ssh_authentication
Provider: Azure
Service: vm
Severity: HIGH
Categories: identity-access
Resource type: microsoft.compute/virtualmachines

​
What this check verifies

Azure Linux virtual machines are assessed for SSH configuration where disablePasswordAuthentication is set to true, allowing only public key authentication and disallowing interactive passwords.

​
Risk

With password-based SSH, attackers can run brute-force or password-spray campaigns. A successful login grants remote shell, enabling command execution, data exfiltration, and lateral movement, degrading confidentiality and integrity.

​
Recommendation

Enforce key-only SSH by setting disablePasswordAuthentication to true and disallowing OS password logins. Use strong, passphrase-protected keys with rotation; restrict SSH via NSGs and private access or Azure Bastion; enable JIT; and apply least privilege.

​
Remediation

# Minimal Terraform to enforce SSH key authentication on a Linux VM
resource "azurerm_linux_virtual_machine" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_location>"
  size                = "Standard_B1s"
  network_interface_ids = ["<example_resource_id>"]
  admin_username        = "azureuser"

  disable_password_authentication = true  # CRITICAL: Disables password-based SSH; enforces SSH key authentication

  admin_ssh_key {                         # Required when password auth is disabled
    username   = "azureuser"
    public_key = "<example_public_key>"
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-focal"
    sku       = "20_04-lts"
    version   = "latest"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = vm_linux_enforce_ssh_authentication. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks