Using Microsoft Entra ID Authentication via Azure Bastion to Log in to a Linux Server with a Custom Terminal Emulator

Question

I followed the official documentation below and was able to log in to a Linux server using Azure CLI with PowerShell as the prompt. Reference: https://learn.microsoft.com/en-us/azure/bastion/connect-vm-native-client-windows#connect-linux

However, I would like to use Microsoft Entra ID authentication to log in to a Linux server using a terminal emulator of my choice.

Is there any documentation available for this?

The terminal emulator I would like to use is: https://teratermproject.github.io/

Thank you in advance.

Answer 1

Hello 井村 鷹希,

To use a custom terminal emulator with Entra ID, the most technically robust method is to treat your emulator (e.g., Windows Terminal, Hyper, or VS Code integrated terminal) as the shell host and execute the native Azure CLI wrapper directly within it. The command az network bastion ssh --name "<BastionName>" --resource-group "<RG>" --target-resource-id "<VMID>" --auth-type "AAD" is specifically engineered to handle the background certificate exchange and then hand off the session to the OpenSSH client. This allows you to work within your preferred visual environment while maintaining the necessary security handshake.

If you strictly require the use of the az network bastion tunnel command to map the connection to a local port (e.g., mapping the VM's port 22 to your localhost:50022), you must manually handle the authentication tokens. This involves running az ssh cert to generate the short-lived RSA key pair and signed certificate, and then configuring your SSH client to explicitly use those generated files (specifically the -i private key and -o CertificateFile options) when connecting to localhost. This manual certificate management is tedious and prone to timeout errors, which is why the direct CLI wrapper command inside your terminal of choice is the official best practice.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

VP

Answer 2

To use Microsoft Entra ID authentication to log in to a Linux server via Azure Bastion using a terminal emulator of your choice, you can follow the general process outlined in the Azure documentation. Here are the steps you would typically follow:

1. Install Azure CLI: Make sure you have the Azure CLI installed on your local machine.
2. Login to Azure: Use the command az login to authenticate your Azure account.
3. Connect to the Linux VM: Use the az network bastion ssh command with the appropriate parameters. For example:

      az network bastion ssh --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-resource-id "<VMResourceId>" --auth-type "AAD"
   

   This command will allow you to authenticate using Microsoft Entra ID.
4. Using a Custom Terminal Emulator: If you want to use a terminal emulator like Tera Term, you will need to set up a tunnel using the az network bastion tunnel command. This allows you to connect to the VM using SSH or RDP through your chosen terminal emulator. The command would look something like this:

      az network bastion tunnel --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-resource-id "<VMResourceId>" --resource-port "<TargetVMPort>" --port "<LocalMachinePort>"
   

   After establishing the tunnel, you can connect to the VM using your terminal emulator by specifying the local port you used in the command.

For more detailed instructions and specific configurations, you may refer to the Azure documentation on connecting to a Linux VM using Bastion and Microsoft Entra ID authentication.

---

References:

• Connect to a VM using Bastion and a Linux native client
• SSH authentication with Microsoft Entra ID