Linux machines should require SSH keys for authentication
Using passwords with SSH still leaves the VM vulnerable to brute-force attacks. The most secure option for authenticating to an Azure Linux virtual machine over SSH is with a public-private key pair, also known as SSH keys.
With password-based SSH, attackers can run brute-force or password-spray campaigns. A successful login grants remote shell, enabling command execution, data exfiltration, and lateral movement, degrading confidentiality and integrity.
What this control checks
Linux machines must require SSH keys for authentication
Common pitfalls
Ensure an SSH public key is provided
Ensure an SSH public key is provided (adminPassword must be absent).
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Authentication to Linux machines should require SSH keys" (630c64f9-8b6b-4c64-b511-6544ceff6fd6); Prowler check vm_linux_enforce_ssh_authentication (prowler azure --checks vm_linux_enforce_ssh_authentication); PowerPipe control azure_compliance.control.compute_vm_ssh_key_authentication_linux.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-3 (Access Enforcement) and IA-5 (Authenticator Management).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-3 (Access Enforcement) and IA-5 (Authenticator Management).
Framework mappings
The clauses this control is mapped to in each framework.
- Access Enforcement (AC-3)
- IA-5: Authenticator Management
FedRAMP Moderate Baseline Rev 4
- AC-3 Access Enforcement
- IA-5 (1): Password-Based Authentication
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
RBI Cyber Security Framework for UCBs
- Annex I (7.3)
- IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- AC-3 Access Enforcement
- IA-5 Authenticator Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_ssh_key_authentication_linux - Powerpipe Control:
azure_compliance.control.compute_vm_ssh_key_authentication_linux - Prowler Check:
vm_linux_enforce_ssh_authentication - Azure Policy Definition:
630c64f9-8b6b-4c64-b511-6544ceff6fd6
Last reviewed: 2026-10-11