0

After following this quick start guide https://learn.microsoft.com/en-us/azure/virtual-machines/linux/quick-create-terraform, running lastb on the provisioned host shows login attempts from many IP addresses.

The included security rule

  security_rule {
    name                       = "SSH"
    priority                   = 1001
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }

is too permissive. Ideally, it would restrict the source_address to my IP address.

What's the best way to restrict ssh access? Some ideas:

  1. Statically configure my current IP address in main.tf
  2. Dynamically configure the security rule using my current IP address at provision time
  3. Run a post-provisioning script to allow only my current IP address
  4. Something else

Any suggestions?

1 Answer 1

0

This provisions the host with a more restrictive ssh rule.

Add this to variables.tf:

variable "source_address_prefix" {
  type        = string
  description = "Source IP address allowed to make ssh connections."
}

Change the security rule to this:

  security_rule {
    name                       = "ssh"
    priority                   = 1001
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = var.source_address_prefix
    destination_address_prefix = "*"
  }

Set this environment variable (use the actual public IP address you use to connect):

export TF_VAR_source_address_prefix=192.168.1.1

Provision:

terraform apply

Verify no more connection attempts to the newly provisioned Azure VM.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.