Edit

Restrict SSH access to virtual machines in AKS enabled by Azure Arc (AKS on Azure Stack HCI 23H2)

  • Article

Applies to: Azure Stack HCI, version 23H2

This article describes a new security feature in AKS Arc that restricts Secure Shell Protocol (SSH) access to underlying virtual machines (VMs). The feature limits access to only certain IP addresses, and restricts the set of commands that you can run over SSH.

Overview

Currently, anyone with administrator access to AKS enabled by Arc has access to VMs through SSH on any machine. In some scenarios, you might want to limit that access, because unlimited access makes it difficult to pass compliance.

Note

Currently, this capability is available only for a new installation of AKS Arc, and not for upgrades. Only a new installation of AKS Arc can pass the restricted IPs and restrict the commands that run over SSH.

Enable SSH restrictions

The following command limits the set of hosts that can be authorized to be SSH clients. You can only run the SSH commands on those hosts, and the set of commands that you can run is restricted. The hosts are designed either via IP addresses or via CIDR ranges:

az aksarc create --ssh-authorized-ip-ranges CIDR format

The CIDR format is 0.0.0.0/32.

This command does two things: it limits the scope of the command, and it also limits the hosts from which this command can be run.

Next steps