Compute instances use SSH key-based authentication

Check ID: compute_instance_key_based_authentication
Provider: OpenStack
Service: compute
Severity: HIGH
Categories: identity-access, encryption
Resource type: OS::Nova::Server

What this check verifies

OpenStack compute instances (VMs) are evaluated to verify that SSH key-based authentication is configured by checking for an assigned keypair. Password-based authentication is vulnerable to brute-force attacks, credential stuffing, and phishing. SSH keys provide cryptographic authentication resistant to these attacks.

Risk

Instances without SSH key-based authentication are vulnerable to brute-force password attacks, credential stuffing, and password reuse. Attackers can test common passwords, intercept credentials, or exploit leaked passwords from other breaches. Successful SSH access enables malware injection, lateral movement, privilege escalation, and data exfiltration.

Recommendation

Always use SSH keys instead of passwords for instance authentication. Generate keys with strong algorithms (RSA 4096-bit, Ed25519). Protect private keys with passphrases and store securely. Disable password authentication in sshd_config. Rotate keypairs periodically and revoke old keys. Use bastion hosts or VPN for SSH access instead of direct internet exposure.

Remediation

CLI
Terraform
Dashboard steps

chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys sudo systemctl restart sshd ssh -i ~/.ssh/private_key username@instance_ip

# Terraform: ensure compute instance uses SSH key-based authentication

# Create or import keypair
resource "openstack_compute_keypair_v2" "keypair" {
  name       = "production-keypair"
  public_key = file("~/.ssh/id_rsa.pub")
}

resource "openstack_compute_instance_v2" "instance" {
  name            = "secure-instance"
  image_id        = var.image_id
  flavor_id       = var.flavor_id
  # Critical: attach keypair for SSH key-based authentication
  key_pair        = openstack_compute_keypair_v2.keypair.name
  security_groups = ["default"]

  network {
    name = var.network_name
  }

  # Optional: use cloud-init to enforce key-only authentication
  user_data = <<-EOF
    #cloud-config
    ssh_pwauth: false
    disable_root: true
  EOF
}

References

Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_key_based_authentication. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to OpenStack checks

Compute instances are isolated in private networks Compute instances have locked status enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires