DEV Community

Shaheen
Shaheen

Posted on

Securing Azure Linux Virtual Machines with SSH Keys and Network Security Groups

#azure #linux #security #devops

Step 1: Generate an SSH Key Pair

Open your local terminal and generate a 4096-bit RSA key pair for secure authentication:

ssh-keygen -t rsa -b 4096 -C "azureuser@cloud" -f ~/.ssh/azure_vm_key
Enter fullscreen mode Exit fullscreen mode

Verify that two key files were created inside your ~/.ssh/ directory:

  • azure_vm_key (Private key — keep this private)
  • azure_vm_key.pub (Public key — deployed to Azure)

Set strict file permissions on your private key to prevent SSH execution errors:

chmod 400 ~/.ssh/azure_vm_key
Enter fullscreen mode Exit fullscreen mode

Step 2: Provision the Azure Resource Group and Linux VM

Execute the following Azure CLI commands to create an isolated resource group and deploy an Ubuntu 22.04 LTS server:

# Create a Resource Group in East US
az group create --name RG-Linux-Security --location eastus

# Deploy Ubuntu Server VM with SSH Public Key
az vm create \
  --resource-group RG-Linux-Security \
  --name UbuntuSecureServer \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/azure_vm_key.pub \
  --public-ip-sku Standard
Enter fullscreen mode Exit fullscreen mode

Take note of the publicIpAddress returned in the JSON payload upon completion.

Step 3: Configure Inbound NSG Security Rules

Allowing SSH access from 0.0.0.0/0 leaves your virtual machine open to global brute-force attempts. You will lock down port 22 access strictly to your local host IP address.

  1. Retrieve your current public IP address: 
curl -s https://api.ipify.org
Enter fullscreen mode Exit fullscreen mode
  1. Add a high-priority Inbound Security Rule to your VM's Network Security Group: 
az network nsg rule create \
  --resource-group RG-Linux-Security \
  --nsg-name UbuntuSecureServerNSG \
  --name Allow-SSH-From-My-IP \
  --priority 100 \
  --source-address-prefixes YOUR_PUBLIC_IP/32 \
  --source-port-ranges '*' \
  --destination-address-prefixes '*' \
  --destination-port-ranges 22 \
  --access Allow \
  --protocol Tcp
Enter fullscreen mode Exit fullscreen mode

Note: Replace YOUR_PUBLIC_IP with the IP address retrieved from the previous step.

Step 4: Test Connection and Verify Port Enforcement

Establish an SSH connection to your Azure Linux VM using your private key:

ssh -i ~/.ssh/azure_vm_key azureuser@YOUR_VM_PUBLIC_IP
Enter fullscreen mode Exit fullscreen mode

Upon successful authentication, the terminal displays the system banner:

Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-1045-azure x86_64)
azureuser@UbuntuSecureServer:~$
Enter fullscreen mode Exit fullscreen mode

Security Verification

If you attempt to initiate an SSH session from a secondary network or cellular hotspot with a different public IP, the connection will time out, confirming that your NSG rule is actively dropping unauthorized traffic.

Step 5: Clean Up Azure Resources

To avoid incurring charges on your Azure account, remove the resource group and all associated compute assets once complete:

az group delete --name RG-Linux-Security --yes --no-wait
Enter fullscreen mode Exit fullscreen mode

Top comments (0)