Skip to content

Commit a4a30bc

Browse files
CopilotCopilot
authored
Add Azure.Fleet.PublicKey rule for Linux Azure Fleet VM profiles (AZR-000541) (#3719)
1 parent aa2e7bc commit a4a30bc

11 files changed

Lines changed: 792 additions & 4 deletions

File tree

‎docs/changelog.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@ What's changed since v1.47.0:
4444
- Azure Container Registry:
4545
- Check that audit diagnostic logs are enabled for Container Registry by @BernieWhite.
4646
[#3445](https://github.com/Azure/PSRule.Rules.Azure/issues/3445)
47+
- Azure Fleet:
48+
- Check for public key usage on Linux fleet VM profiles by @BernieWhite.
4749
- Container Apps:
4850
- Check that liveness and readiness health probes use HTTP checks for HTTP-based ingress by @BernieWhite.
4951
[#3111](https://github.com/Azure/PSRule.Rules.Azure/issues/3111)

‎docs/en/rules/Azure.Fleet.PublicKey.md‎

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,201 @@
1+
---
2+
reviewed: 2026-04-04
3+
severity: Important
4+
pillar: Security
5+
category: SE:08 Hardening resources
6+
resource: Azure Fleet
7+
resourceType: Microsoft.AzureFleet/fleets
8+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Fleet.PublicKey/
9+
---
10+
11+
# Azure Fleet password-based authentication is enabled
12+
13+
## SYNOPSIS
14+
15+
Use SSH keys instead of common credentials to secure Linux Azure Fleet VMs against malicious activities.
16+
17+
## DESCRIPTION
18+
19+
Linux Azure Fleet virtual machine profiles should have password authentication disabled to help with eliminating password-based attacks.
20+
21+
## RECOMMENDATION
22+
23+
Consider disabling password-based authentication on Linux Azure Fleet VM profiles and instead use public keys.
24+
25+
## EXAMPLES
26+
27+
### Configure with Bicep
28+
29+
To deploy an Azure Fleet that passes this rule:
30+
31+
- Set the `properties.computeProfile.baseVirtualMachineProfile.osProfile.linuxConfiguration.disablePasswordAuthentication` property to `true`.
32+
33+
For example:
34+
35+
```bicep
36+
resource linux_fleet 'Microsoft.AzureFleet/fleets@2024-11-01' = {
37+
name: name
38+
location: location
39+
properties: {
40+
computeProfile: {
41+
baseVirtualMachineProfile: {
42+
osProfile: {
43+
computerNamePrefix: 'fleet'
44+
adminUsername: adminUsername
45+
linuxConfiguration: {
46+
disablePasswordAuthentication: true
47+
provisionVMAgent: true
48+
ssh: {
49+
publicKeys: [
50+
{
51+
path: '/home/azureuser/.ssh/authorized_keys'
52+
keyData: sshPublicKey
53+
}
54+
]
55+
}
56+
}
57+
}
58+
storageProfile: {
59+
imageReference: {
60+
publisher: 'MicrosoftCblMariner'
61+
offer: 'azure-linux-3'
62+
sku: 'azure-linux-3-gen2'
63+
version: 'latest'
64+
}
65+
osDisk: {
66+
createOption: 'FromImage'
67+
caching: 'ReadWrite'
68+
managedDisk: {
69+
storageAccountType: 'Premium_LRS'
70+
}
71+
}
72+
}
73+
networkProfile: {
74+
networkInterfaceConfigurations: [
75+
{
76+
name: 'netconfig'
77+
properties: {
78+
ipConfigurations: [
79+
{
80+
name: 'ipconfig'
81+
properties: {
82+
primary: true
83+
subnet: {
84+
id: subnetId
85+
}
86+
}
87+
}
88+
]
89+
}
90+
}
91+
]
92+
}
93+
}
94+
}
95+
vmSizesProfile: [
96+
{
97+
name: 'Standard_D8ds_v6'
98+
rank: 0
99+
}
100+
]
101+
regularPriorityProfile: {
102+
minCapacity: 1
103+
capacity: 5
104+
allocationStrategy: 'Prioritized'
105+
}
106+
}
107+
}
108+
```
109+
110+
### Configure with Azure template
111+
112+
To deploy an Azure Fleet that passes this rule:
113+
114+
- Set the `properties.computeProfile.baseVirtualMachineProfile.osProfile.linuxConfiguration.disablePasswordAuthentication` property to `true`.
115+
116+
For example:
117+
118+
```json
119+
{
120+
"type": "Microsoft.AzureFleet/fleets",
121+
"apiVersion": "2024-11-01",
122+
"name": "[parameters('name')]",
123+
"location": "[parameters('location')]",
124+
"properties": {
125+
"computeProfile": {
126+
"baseVirtualMachineProfile": {
127+
"osProfile": {
128+
"computerNamePrefix": "fleet",
129+
"adminUsername": "[parameters('adminUsername')]",
130+
"linuxConfiguration": {
131+
"disablePasswordAuthentication": true,
132+
"provisionVMAgent": true,
133+
"ssh": {
134+
"publicKeys": [
135+
{
136+
"path": "/home/azureuser/.ssh/authorized_keys",
137+
"keyData": "[parameters('sshPublicKey')]"
138+
}
139+
]
140+
}
141+
}
142+
},
143+
"storageProfile": {
144+
"imageReference": {
145+
"publisher": "MicrosoftCblMariner",
146+
"offer": "Cbl-Mariner",
147+
"sku": "cbl-mariner-2-gen2",
148+
"version": "latest"
149+
},
150+
"osDisk": {
151+
"createOption": "FromImage",
152+
"caching": "ReadWrite",
153+
"managedDisk": {
154+
"storageAccountType": "Premium_LRS"
155+
}
156+
}
157+
},
158+
"networkProfile": {
159+
"networkInterfaceConfigurations": [
160+
{
161+
"name": "netconfig",
162+
"properties": {
163+
"ipConfigurations": [
164+
{
165+
"name": "ipconfig",
166+
"properties": {
167+
"primary": true,
168+
"subnet": {
169+
"id": "[parameters('subnetId')]"
170+
}
171+
}
172+
}
173+
]
174+
}
175+
}
176+
]
177+
}
178+
}
179+
},
180+
"vmSizesProfile": [
181+
{
182+
"name": "Standard_D8ds_v6",
183+
"rank": 0
184+
}
185+
],
186+
"regularPriorityProfile": {
187+
"minCapacity": 1,
188+
"capacity": 5,
189+
"allocationStrategy": "Prioritized"
190+
}
191+
}
192+
}
193+
```
194+
195+
## LINKS
196+
197+
- [SE:08 Hardening resources](https://learn.microsoft.com/azure/well-architected/security/harden-resources)
198+
- [Security: Level 2](https://learn.microsoft.com/azure/well-architected/security/maturity-model?tabs=level2)
199+
- [Azure security baseline for Linux Virtual Machines](https://learn.microsoft.com/security/benchmark/azure/baselines/virtual-machines-linux-virtual-machines-security-baseline)
200+
- [Detailed steps: Create and manage SSH keys for authentication to a Linux VM in Azure](https://learn.microsoft.com/azure/virtual-machines/linux/create-ssh-keys-detailed)
201+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.azurefleet/fleets)

‎docs/en/rules/Azure.VMSS.PublicKey.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,7 @@ resource vmss 'Microsoft.Compute/virtualMachineScaleSets@2024-07-01' = {
212212
## LINKS
213213

214214
- [SE:08 Hardening resources](https://learn.microsoft.com/azure/well-architected/security/harden-resources)
215-
- [Azure security baseline for Linux Virtual Machines](https://learn.microsoft.com/security/benchmark/azure/baselines/virtual-machines-linux-security-baseline)
215+
- [Security: Level 2](https://learn.microsoft.com/azure/well-architected/security/maturity-model?tabs=level2)
216+
- [Azure security baseline for Linux Virtual Machines](https://learn.microsoft.com/security/benchmark/azure/baselines/virtual-machines-linux-virtual-machines-security-baseline)
216217
- [Detailed steps: Create and manage SSH keys for authentication to a Linux VM in Azure](https://learn.microsoft.com/azure/virtual-machines/linux/create-ssh-keys-detailed)
217218
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.compute/virtualmachinescalesets)

‎docs/examples/resources/fleet.bicep‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ param secret string
1919
@description('The ID of the subnet where the fleet will be deployed.')
2020
param subnetId string
2121

22+
@description('The SSH public key for the local administrator account.')
23+
param sshPublicKey string
24+
2225
// An example of creating a fleet resource with a Trusted Launch security profile.
2326
resource windows_fleet 'Microsoft.AzureFleet/fleets@2024-11-01' = {
2427
name: name
@@ -79,3 +82,82 @@ resource windows_fleet 'Microsoft.AzureFleet/fleets@2024-11-01' = {
7982
'3'
8083
]
8184
}
85+
86+
// An example of creating a Linux fleet resource with SSH public key authentication.
87+
resource linux_fleet 'Microsoft.AzureFleet/fleets@2024-11-01' = {
88+
name: name
89+
location: location
90+
properties: {
91+
computeProfile: {
92+
baseVirtualMachineProfile: {
93+
osProfile: {
94+
computerNamePrefix: 'fleet'
95+
adminUsername: adminUsername
96+
linuxConfiguration: {
97+
disablePasswordAuthentication: true
98+
provisionVMAgent: true
99+
ssh: {
100+
publicKeys: [
101+
{
102+
path: '/home/azureuser/.ssh/authorized_keys'
103+
keyData: sshPublicKey
104+
}
105+
]
106+
}
107+
}
108+
}
109+
storageProfile: {
110+
imageReference: {
111+
publisher: 'MicrosoftCblMariner'
112+
offer: 'azure-linux-3'
113+
sku: 'azure-linux-3-gen2'
114+
version: 'latest'
115+
}
116+
osDisk: {
117+
createOption: 'FromImage'
118+
caching: 'ReadWrite'
119+
managedDisk: {
120+
storageAccountType: 'Premium_LRS'
121+
}
122+
}
123+
}
124+
networkProfile: {
125+
networkInterfaceConfigurations: [
126+
{
127+
name: 'netconfig'
128+
properties: {
129+
ipConfigurations: [
130+
{
131+
name: 'ipconfig'
132+
properties: {
133+
primary: true
134+
subnet: {
135+
id: subnetId
136+
}
137+
}
138+
}
139+
]
140+
}
141+
}
142+
]
143+
}
144+
}
145+
}
146+
vmSizesProfile: [
147+
{
148+
name: 'Standard_D8ds_v6'
149+
rank: 0
150+
}
151+
]
152+
regularPriorityProfile: {
153+
minCapacity: 1
154+
capacity: 5
155+
allocationStrategy: 'Prioritized'
156+
}
157+
}
158+
zones: [
159+
'1'
160+
'2'
161+
'3'
162+
]
163+
}

0 commit comments

Comments
 (0)