Export-AzSshConfig

Module:

Az.Ssh Module

This cmdlet exports an SSH configuration file that can be used to connect to Azure Resources through client applications that support OpenSSH config and certificates. SSH config files can be created that use Microsoft Entra ID issued certificates or local user credentials.

Syntax

Interactive (Default)

Export-AzSshConfig
    -ResourceGroupName <String>
    -Name <String>
    -ConfigFilePath <String>
    [-PublicKeyFile <String>]
    [-PrivateKeyFile <String>]
    [-UsePrivateIp]
    [-LocalUser <String>]
    [-Port <String>]
    [-ResourceType <String>]
    [-CertificateFile <String>]
    [-Overwrite]
    [-KeysDestinationFolder <String>]
    [-Force]
    [-DefaultProfile <IAzureContextContainer>]
    [<CommonParameters>]

IpAddress

Export-AzSshConfig
    -Ip <String>
    -ConfigFilePath <String>
    [-PublicKeyFile <String>]
    [-PrivateKeyFile <String>]
    [-LocalUser <String>]
    [-Port <String>]
    [-CertificateFile <String>]
    [-Overwrite]
    [-KeysDestinationFolder <String>]
    [-Force]
    [-DefaultProfile <IAzureContextContainer>]
    [<CommonParameters>]

ResourceId

Export-AzSshConfig
    -ResourceId <String>
    -ConfigFilePath <String>
    [-PublicKeyFile <String>]
    [-PrivateKeyFile <String>]
    [-UsePrivateIp]
    [-LocalUser <String>]
    [-Port <String>]
    [-CertificateFile <String>]
    [-Overwrite]
    [-KeysDestinationFolder <String>]
    [-Force]
    [-DefaultProfile <IAzureContextContainer>]
    [<CommonParameters>]

Description

The exported SSH configuration file can be used to connect to Azure Resources by client applications that support OpenSSH config and certificates. Applications such as git and rsync can use configuration file by setting the command to 'ssh -F /path/to/config'. For example: rsync -e 'ssh -F /path/to/config'. Users can create ssh config files that use Microsoft Entra ID issued certificates or local user credentials. Important note: When connecting to Azure Arc resources, this cmdlet requires the Az.Ssh.ArcProxy module to also be installed in the client machine. The cmdlet will attempt to install the module from the PowerShell Gallery, but the user also has the option to install it themselves. It is important that the user also has permission to execute the Proxy files in the Az.Ssh.ArcProxy module, or the connection will fail. You can find the Az.Ssh.ArcServer module in the PowerShell Gallery: https://aka.ms/PowerShellGallery-Az.Ssh.ArcProxy.

Examples

Example 1: Export a SSH configuration file for connecting to a resource using Microsoft Entra ID issued certificates for authentication.

Export-AzSshConfig -ResourceGroupName myRg -Name myMachine -ConfigFilePath ./sshconfig.config

When a -LocalUser is not supplied, the cmdlet will attempt to create a certificate to login using Microsoft Entra ID. This is currently only supported for resources running Linux OS. When using Microsoft Entra ID to login to resource, the Host name in the configuration entry will be "{resource group name}-{resource name}", or "{ip address}" for Azure VMs.

Example 2: Export a SSH configuration file for connecting to the Public Ip of an Azure Virtual Machine using Microsoft Entra ID issued certificates.

Export-AzSshConfig -Ip 1.2.3.4 -ConfigFilePath ./sshconfig.config

Example 3: Export a SSH configuration file for connecting to Local User on Azure Resource using SSH certificates for authentication

Export-AzSshConfig -ResourceGroupName myRg -Name myVm -LocalUser azureuser -CertificateFile ./cert -PrivateKeyFile ./id_rsa -ConfigFilePath ./sshconfig.config

When using local user credentials to login, the host name in the configuration entry will be "{resource group name}-{resource name}-{username}", or "{ip address}-{username}" for Azure VMs.

Example 4: Export a SSH configuration file for connecting to Local User on Azure Resource using SSH private key for authentication

Export-AzSshConfig -ResourceGroupName myRg -Name myVm -LocalUser azureuser -PrivateKeyFile ./id_rsa -ConfigFilePath ./sshconfig.config

Example 5: Export a SSH configuration file for connecting to Local User on Azure Resource using interactive username and password for authentication

Export-AzSshConfig -ResourceGroupName myRg -Name myVm -LocalUser azureuser -ConfigFilePath ./sshconfig.config

Example 6: Determine where generated keys and certificates for the certificate will the stored.

Export-AzSshConfig -ResourceGroupName myRg -Name myVm -KeysDestinationFolder /home/user/mykeys -ConfigFilePath ./sshconfig.config

Generated keys and certificates are, by default, stored in "az_ssh_config" directory in the same directory as the config file. The -KeysDestinationFolder parameter allows user to decide where the keys will be stored.

Example 7: Create a generic config for use with any Azure VM.

Export-AzSshConfig -Ip * -ConfigFilePath ./sshconfig.config

Example 8: Provide the Resource Type of the target.

Export-AzSshConfig -ResourceGroupName myRg -Name myVm -ResourceType Microsoft.Compute/virtualMachines -ConfigFilePath ./sshconfig.config

This parameter is useful when there is more than one supported resource with the same name in the Resource Group.

Parameters

-CertificateFile

SSH Certificate to be used to authenticate to local user account.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ConfigFilePath

Path to write SSH configuration to.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DefaultProfile

The credentials, account, tenant, and subscription used for communication with Azure.

Parameter properties

Type:	IAzureContextContainer
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	AzContext, AzureRmContext, AzureCredential

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Force

When connecting to Arc resources, do not prompt for confirmation before updating the allowed port for SSH connection in the Connection Endpoint to match the target port or to install Az.Ssh.ArcProxy module from the PowerShell Gallery, if needed.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Ip

IP Address of target Azure VM.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

IpAddress

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-KeysDestinationFolder

Directory where generated keys and certificates will be stored.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-LocalUser

Username for a local user in the target resource.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Name

Name of the target Azure Resource.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

Interactive

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-Overwrite

Overwrite the config file, instead of appending new entry to the end of the file.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Port

Port to connect to on the remote host.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-PrivateKeyFile

Path to private key file.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-PublicKeyFile

Path to public key file.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ResourceGroupName

Resource group name.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

Interactive

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-ResourceId

Resource ID of the target resource.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

ResourceId

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	True
Value from remaining arguments:	False

-ResourceType

Resource type of the target resource.

Parameter properties

Type:	String
Default value:	None
Accepted values:	Microsoft.HybridCompute/machines, Microsoft.Compute/virtualMachines, Microsoft.ConnectedVMwarevSphere/virtualMachines, Microsoft.ScVmm/virtualMachines, Microsoft.AzureStackHCI/virtualMachines
Supports wildcards:	False
DontShow:	False

Parameter sets

Interactive

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-UsePrivateIp

When connecting to an Azure VM, this flag specifies that it should connect to one of the private IPs of the VM. It requires connectivity to the private IP.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

Interactive

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

ResourceId

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

String

Outputs

PSSshConfigEntry

Related Links

• SSH Access to Arzure Arc-enabled servers
• Troubleshoot SSH access to Azure Arc Enabled Servers
• Login to a Linux VM by using Microsoft Entra ID
• Install OpenSSH for Windows