Eager to master hybrid server management? Discover how to administer Windows Server Hybrid Core Infrastructure on Azure, setting your path towards the Microsoft Certified: Azure Hybrid Infrastructure Administrator Associate certification!
Gauge your current knowledge
Gauge your current knowledge
SSH (Secure Shell) is a network protocol that gives administrators a secure way to access and manage remote servers. On hybrid Windows Servers that connect on-premises infrastructure to Azure, SSH lets teams manage machines without being physically present. Setting up SSH correctly protects these remote connections from unauthorized access while keeping them functional for legitimate administration work.
Windows Server 2019 and later versions have built-in support for SSH through the Win32 OpenSSH project. For Azure virtual machines, you deploy SSH support using a VM extension called WindowsOpenSSH, which can be installed through Azure CLI or PowerShell commands. Once installed, the SSH service runs on the server and listens for incoming connections on TCP port 22.
For the SSH connection to reach the server, the Network Security Group (NSG) attached to the VM must have an inbound rule that allows traffic on port 22. Without this rule, SSH requests will be blocked before they reach the server, even if OpenSSH is properly installed. The NSG acts as a filter at the network boundary, deciding which traffic gets through and which gets dropped.
Password-based SSH logins are vulnerable to brute-force attacks where attackers try many password combinations automatically. Key-based authentication replaces passwords with cryptographic key pairs, making unauthorized access much harder. The administrator generates a key pair using the ssh-keygen command, keeps the private key safely on their local machine, and copies the public key to the server using ssh-copy-id.
When the user connects to the server, the SSH client proves it holds the matching private key without ever sending the key across the network. This means even if someone intercepts the connection, they cannot steal the credentials. Organizations should require key-based authentication and disable password login entirely for SSH to achieve the strongest security.
Connecting SSH authentication to Azure Active Directory (Azure AD) lets administrators use their existing organizational credentials instead of managing separate SSH keys for each server. This integration allows IT teams to apply conditional access policies that require multi-factor authentication or check device compliance before allowing SSH connections. When a user authenticates through Azure AD, the server validates the token rather than checking local user accounts.
Azure AD integration also simplifies account management because when an employee leaves the organization, disabling their Azure AD account immediately revokes access to all connected servers. This centralizes security control and reduces the risk of orphaned accounts that still have access.
Azure Bastion provides SSH connectivity without exposing the VM's management ports to the public internet. Instead of opening port 22 in the NSG to allow traffic from anywhere, the Bastion host sits inside the virtual network and connects to VMs through the internal network. Users access the Bastion through the Azure portal, and the Bastion then establishes the SSH session to the target VM.
This approach removes the need for a public IP address on the VM itself, which significantly reduces the attack surface. The Bastion host handles the encryption and authentication, and organizations should deploy it using the Standard SKU or higher to support SSH connections properly. Traffic flows from the user to the Bastion, then from the Bastion to the VM, creating a secure tunnel that never exposes the server directly to the internet.
Logging SSH sessions helps organizations detect unauthorized access attempts and investigate security incidents. Administrators should enable comprehensive logging on the SSH server to capture connection attempts, authenticated users, and commands executed during each session. These logs can be sent to Azure Log Analytics or a centralized logging system for review.
Regularly analyzing SSH logs reveals patterns such as repeated failed login attempts indicating a brute-force attack, connections from unusual IP addresses, or sessions occurring outside normal business hours. Setting up automated alerts for suspicious activity ensures the security team responds quickly to potential threats. Audit logs also support compliance requirements by proving who accessed which servers and when.
StudyCerts
StudyCerts