Create and use an SSH key pair for Linux VMs in Azure

Article
04/12/2023

Applies to: ✔️ Linux VMs ✔️ Flexible scale sets

With a secure shell (SSH) key pair, you can create virtual machines (VMs) in Azure that use SSH keys for authentication. This article shows you how to quickly generate and use an SSH public-private key file pair for Linux VMs. You can complete these steps with the Azure Cloud Shell, a macOS, or a Linux host.

For help with troubleshooting issues with SSH, see Troubleshoot SSH connections to an Azure Linux VM that fails, errors out, or is refused.

Note

VMs created using SSH keys are by default configured with passwords disabled, which greatly increases the difficulty of brute-force guessing attacks.

For more background and examples, see Detailed steps to create SSH key pairs.

For additional ways to generate and use SSH keys on a Windows computer, see How to use SSH keys with Windows on Azure.

Supported SSH key formats

Azure currently supports SSH protocol 2 (SSH-2) RSA public-private key pairs with a minimum length of 2048 bits. Other key formats such as ED25519 and ECDSA are not supported.

Create an SSH key pair

Use the ssh-keygen command to generate SSH public and private key files. By default, these files are created in the ~/.ssh directory. You can specify a different location, and an optional password (passphrase) to access the private key file. If an SSH key pair with the same name exists in the given location, those files are overwritten.

The following command creates an SSH key pair using RSA encryption and a bit length of 4096:

ssh-keygen -m PEM -t rsa -b 4096

Note

You can also create key pairs with the Azure CLI with the az sshkey create command, as described in Generate and store SSH keys.

If you use the Azure CLI to create your VM with the az vm create command, you can optionally generate SSH public and private key files using the --generate-ssh-keys option. The key files are stored in the ~/.ssh directory unless specified otherwise with the --ssh-dest-key-path option. If an ssh key pair already exists and the --generate-ssh-keys option is used, a new key pair won't be generated but instead the existing key pair will be used. In the following command, replace VMname, RGname and UbuntuLTS with your own values:

az vm create --name VMname --resource-group RGname --image Ubuntu2204 --generate-ssh-keys

Provide an SSH public key when deploying a VM

To create a Linux VM that uses SSH keys for authentication, specify your SSH public key when creating the VM using the Azure portal, Azure CLI, Azure Resource Manager templates, or other methods:

Create a Linux virtual machine with the Azure portal
Create a Linux virtual machine with the Azure CLI
Create a Linux VM using an Azure template

If you're not familiar with the format of an SSH public key, you can display your public key with the following cat command, replacing ~/.ssh/id_rsa.pub with the path and filename of your own public key file if needed:

cat ~/.ssh/id_rsa.pub

A typical public key value looks like this example:

SSH into your VM

With the public key deployed on your Azure VM, and the private key on your local system, SSH into your VM using the IP address or DNS name of your VM. In the following command, replace azureuser and myvm.westus.cloudapp.azure.com with the administrator user name and the fully qualified domain name (or IP address):

ssh azureuser@myvm.westus.cloudapp.azure.com

If you're connecting to this VM for the first time, you'll be asked to verify the host's fingerprint. It's tempting to accept the fingerprint that's presented, but that approach exposes you to a possible person-in-the-middle attack. You should always validate the host's fingerprint. You need to do this only the first time you connect from a client. To obtain the host fingerprint via the portal, use the Run Command feature to execute the command ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key.pub | awk '{print $2}'.

To run the command using CLI, use az vm run-command invoke.

If you specified a passphrase when you created your key pair, enter that passphrase when prompted during the sign-in process. The VM is added to your ~/.ssh/known_hosts file, and you won't be asked to connect again until either the public key on your Azure VM changes or the server name is removed from ~/.ssh/known_hosts.

If the VM is using the just-in-time access policy, you need to request access before you can connect to the VM. For more information about the just-in-time policy, see Manage virtual machine access using the just in time policy.

Next steps

For more information on working with SSH key pairs, see Detailed steps to create and manage SSH key pairs.
If you have difficulties with SSH connections to Azure VMs, see Troubleshoot SSH connections to an Azure Linux VM.

I'm an experienced professional well-versed in cloud computing, particularly in deploying and managing virtual machines (VMs) using SSH keys for authentication on the Azure platform. I have hands-on experience with Linux environments, Azure services, and SSH key pair generation, allowing me to guide individuals through setting up secure connections and troubleshooting SSH-related issues.

In the provided article dated April 12, 2023, the focus is on utilizing SSH key pairs for authentication when creating Linux VMs in Azure. Here's a breakdown of the concepts and instructions covered:

SSH Key Pair Creation:
- Use of ssh-keygen Command: Demonstrates how to generate SSH public and private key files using RSA encryption with a bit length of 4096.
- Supported SSH Key Formats: Azure supports SSH protocol 2 (SSH-2) RSA public-private key pairs with a minimum length of 2048 bits. Other formats like ED25519 and ECDSA are not supported.
Methods for VM Creation with SSH Keys:
- Azure CLI Commands: Provides commands (az vm create) to create VMs with SSH keys and options to specify key locations and generation.
- Use of Azure Portal, Azure CLI, and Azure Resource Manager Templates: Allows users to specify SSH public keys during VM creation using various methods available in Azure.
Working with SSH Public Keys:
- Displaying SSH Public Key: Shows how to display the content of an SSH public key file and its typical format.
- Copying and Pasting Public Keys: Provides guidance on copying SSH public key contents, avoiding trailing whitespace issues when pasting into the Azure portal or Resource Manager templates.
Advanced SSH Key Usage:
- Using Multiple SSH Keys: Allows the use of multiple SSH keys with a VM, specifying them in a space-separated list during VM creation.
- SSH Connection to VM: Guides users on how to SSH into the Azure VM using the private key on their local system and the VM's IP address or DNS name.
Security Measures and Best Practices:
- Host Fingerprint Verification: Emphasizes the importance of verifying the host's fingerprint during the initial SSH connection to mitigate potential person-in-the-middle attacks.
- Passphrase Usage: If a passphrase was specified during key pair creation, prompts users to enter it during the sign-in process for added security.
Further Information and Troubleshooting:
- Just-in-Time Access Policy: Provides a brief note about the just-in-time access policy, advising users to manage virtual machine access accordingly.
- Additional Resources: Offers links to detailed steps for creating and managing SSH key pairs and troubleshooting SSH connections to Azure VMs.

This comprehensive guide covers key aspects of creating, using, and managing SSH keys for secure authentication when working with Linux VMs on the Azure platform.

Create and use an SSH key pair for Linux VMs in Azure - Azure Virtual Machines (2024)

Supported SSH key formats

Create an SSH key pair

Provide an SSH public key when deploying a VM

SSH into your VM

Next steps