Securing Azure Linux Virtual Machines with SSH Keys and Network Security Groups

Step 1: Generate an SSH Key Pair Open your local terminal and generate a 4096-bit RSA key pair for secure authentication: ssh-keygen -t rsa -b 4096 -C "azureuser@cloud" -f ~/.ssh/azure_vm_key Enter fullscreen mode Exit fullscreen mode Verify that two key files were created inside your ~/.ssh/ directory: azure_vm_key (Private key — keep this private) azure_vm_key.pub (Public key — deployed to Azure) Set strict file permissions on your private key to prevent SSH execution errors: chmod 400 ~/.ssh/azure_vm_key Enter fullscreen mode Exit fullscreen mode Step 2: Provision the Azure Resource Group and Linux VM Execute the following Azure CLI commands to create an isolated resource group and deploy an Ubuntu 22.04 LTS server: # Create a Resource Group in East US az group create --name RG-Linux-Security --location eastus # Deploy Ubuntu Server VM with SSH Public Key az vm create \ --resource-group RG-Linux-Security \ --name UbuntuSecureServer \ --image Ubuntu2204 \ --admin-username azureuser \ --ssh-key-values ~/.ssh/azure_vm_key.pub \ --public-ip-sku Standard Enter fullscreen mode Exit fullscreen mode Take note of the publicIpAddress returned in the JSON payload upon completion. Step 3: Configure Inbound NSG Security Rules Allowing SSH access from 0.0.0.0/0 leaves your virtual machine open to global brute-force attempts. You will lock down port 22 access strictly to your local host IP address. Retrieve your current public IP address: curl -s https://api.ipify.org Enter fullscreen mode Exit fullscreen mode Add a high-priority Inbound Security Rule to your VM's Network Security Group: az network nsg rule create \ --resource-group RG-Linux-Security \ --nsg-name UbuntuSecureServerNSG \ --name Allow-SSH-From-My-IP \ --priority 100 \ --source-address-prefixes YOUR_PUBLIC_IP/32 \ --source-port-ranges '*' \ --destination-address-prefixes '*' \ --destination-port-ranges 22 \ --access Allow \ --protocol Tcp Enter fullscreen mode Exit fullscreen mode Note: Replace YOUR_PUBLIC_IP with the IP address retrieved from the previous step. Step 4: Test Connection and Verify Port Enforcement Establish an SSH connection to your Azure Linux VM using your private key: ssh -i ~/.ssh/azure_vm_key azureuser@YOUR_VM_PUBLIC_IP Enter fullscreen mode Exit fullscreen mode Upon successful authentication, the terminal displays the system banner: Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-1045-azure x86_64) azureuser@UbuntuSecureServer:~$ Enter fullscreen mode Exit fullscreen mode Security Verification If you attempt to initiate an SSH session from a secondary network or cellular hotspot with a different public IP, the connection will time out, confirming that your NSG rule is actively dropping unauthorized traffic. Step 5: Clean Up Azure Resources To avoid incurring charges on your Azure account, remove the resource group and all associated compute assets once complete: az group delete --name RG-Linux-Security --yes --no-wait Enter fullscreen mode Exit fullscreen mode