Azure: SSH to a VM on Azure

SSH allows for remote encrypted connection between a two computers (typically a client and server) using cryptography to authenticate and encrypt connection between the devices. In this guide, we would explore how to connect to a virtual machine created on microsoft azure using SSH.

A Brief Overview of SSH

Secure SHell (SSH) is a protocol on the application layer of the OSI model. It is used for remote encrypted connection between two devices. It uses asymmetric key cryptography techniques to safely create a shared key for both devices without needing to send the key across the network. It then uses the shared (symmetric) key for further encryption over the channel. SSH runs on TCP port 22 by default.

Creating a VM on Azure

Login to your azure portal and click on the "Create a Resource" option on the dashboard (you can also find that option on the navigation bar).

Now in the create resource page, select Virtual machine , you will be navigated to the Create Virtual Machine page. Enter the required information to create your vm. A few things to pay attention to in regards to this article, for the_ Authentication Type_ in the Administrator Account section, select SSH public key as the means to authenticate. Enter your vm username, generate a new key pair (except your need requires you to use an existing keypair), for the key type I recommend Ed25519 because it is faster and then enter your keypair name. Another important thing is the inbound port rule, make sure port 22 is open.

Once you're done with all your network, storage and other configurations, you can go ahead and create the vm.

Connecting to the virtual machine

When you created the vm, a key.pem file was downloaded into your computer, this will be used for authentication. First of all, move this file to the ~/.ssh folder (create one if it's not already there). Now change the the permissions of the key.pem file to give readonly access.

chmod 400 ~/.ssh/key.pem

Now all we need is the public IP address of our virtual machine, we can get it on our azure portal.

To connect to our cloud vm, we run this command on our teminal:

ssh -i ~/.ssh/key.pem testvm@102.113.114.200

In general, the syntax is:

ssh -i <path_to_key_file> <vm_name>@<vm_ip_addr>

Now since this is the first time connecting to the vm, we will get a message like this:

The authenticity of host '102.133.144.206 (102.133.144.206)' can't be established.
ED25519 key fingerprint is SHA256:bbZQo2Ph2ZV77Koob9iQT7i0G+oDNZVo9Q3fMg89T64.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? y
Please type 'yes', 'no' or the fingerprint: yes

What this means is we should verify the host (the vm) fingerprint before connecting. Now even though we just created the vm, we should still verify the returned fingerprint to make sure this response is actually from the vm. We need to make sure the figerprint on the server matches the one returned to us. We can do this by running this command on the vm through our azure portal.

ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub | awk '{print $2}'

To run a command on your vm through the azure portal, go to the vm dashboard, in the sidebar, navigate to operations, and click run command. In the current page, click run shell script and enter the command above.