Skip to content

Commit 096105e

Browse files
BernieWhiteBernieWhite
authored
Updates to WAF documentation (Azure#3194)
1 parent 6600b30 commit 096105e

11 files changed

+449
-154
lines changed

‎docs/CHANGELOG-v1.md

+4-1
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,11 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers
3131

3232
What's changed since pre-release v1.40.0-B0147:
3333

34+
- Engineering:
35+
- Quality updates to rule documentation by @BernieWhite.
36+
[#3102](https://github.com/Azure/PSRule.Rules.Azure/issues/3102)
3437
- Bug fixes:
35-
- Fixed evaluation of APIM policies when using embedded C# with quotes by #BernieWhite.
38+
- Fixed evaluation of APIM policies when using embedded C# with quotes by @BernieWhite.
3639
[#3184](https://github.com/Azure/PSRule.Rules.Azure/issues/3184)
3740

3841
## v1.40.0-B0147 (pre-release)

‎docs/en/rules/Azure.Monitor.ServiceHealth.md

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
severity: Important
3-
pillar: Operational Excellence
4-
category: Monitoring
3+
pillar: Reliability
4+
category: RE:10 Monitoring and alerting
55
resource: Monitor
66
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Monitor.ServiceHealth/
77
---
@@ -27,5 +27,6 @@ Consider configuring an alert to notify administrators when services you are usi
2727

2828
## LINKS
2929

30+
- [RE:10 Monitoring and alerting](https://learn.microsoft.com/azure/well-architected/reliability/monitoring-alerting-strategy)
3031
- [Service Health overview](https://learn.microsoft.com/azure/service-health/service-health-overview)
3132
- [Create activity log alerts on service notifications](https://learn.microsoft.com/azure/service-health/alerts-activity-log-service-notifications)

‎docs/en/rules/Azure.VM.PublicKey.md

+130-4
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,147 @@
11
---
22
severity: Important
33
pillar: Security
4-
category: Identity and access management
4+
category: SE:08 Hardening resources
55
resource: Virtual Machine
66
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.VM.PublicKey/
77
---
88

9-
# Use public keys for Linux
9+
# VM password-based authentication is enabled
1010

1111
## SYNOPSIS
1212

1313
Linux virtual machines should use public keys.
1414

1515
## DESCRIPTION
1616

17-
Linux virtual machines support either password or public key based authentication for the default administrator account.
17+
Linux virtual machines should have password authentication disabled to help with eliminating password-based attacks.
1818

1919
## RECOMMENDATION
2020

21-
Consider using public key based authentication instead of passwords.
21+
Consider disabling password-based authentication on Linux virtual machines and instead use public keys.
22+
23+
## EXAMPLES
24+
25+
### Configure with Azure template
26+
27+
To deploy virtual machines that pass this rule:
28+
29+
- Set the `properties.osProfile.linuxConfiguration.disablePasswordAuthentication` property to `true`.
30+
31+
For example:
32+
33+
```json
34+
{
35+
"type": "Microsoft.Compute/virtualMachines",
36+
"apiVersion": "2024-03-01",
37+
"name": "[parameters('name')]",
38+
"location": "[parameters('location')]",
39+
"identity": {
40+
"type": "SystemAssigned"
41+
},
42+
"properties": {
43+
"hardwareProfile": {
44+
"vmSize": "Standard_D8d_v5"
45+
},
46+
"osProfile": {
47+
"computerName": "[parameters('name')]",
48+
"adminUsername": "[parameters('adminUsername')]",
49+
"linuxConfiguration": {
50+
"disablePasswordAuthentication": true
51+
}
52+
},
53+
"storageProfile": {
54+
"imageReference": {
55+
"publisher": "MicrosoftCblMariner",
56+
"offer": "Cbl-Mariner",
57+
"sku": "cbl-mariner-2-gen2",
58+
"version": "latest"
59+
},
60+
"osDisk": {
61+
"name": "[format('{0}-disk0', parameters('name'))]",
62+
"caching": "ReadWrite",
63+
"createOption": "FromImage",
64+
"managedDisk": {
65+
"storageAccountType": "Premium_LRS"
66+
}
67+
}
68+
},
69+
"networkProfile": {
70+
"networkInterfaces": [
71+
{
72+
"id": "[resourceId('Microsoft.Network/networkInterfaces', parameters('nicName'))]"
73+
}
74+
]
75+
}
76+
},
77+
"zones": [
78+
"1"
79+
],
80+
"dependsOn": [
81+
"[resourceId('Microsoft.Network/networkInterfaces', parameters('nicName'))]"
82+
]
83+
}
84+
```
85+
86+
### Configure with Bicep
87+
88+
To deploy virtual machines that pass this rule:
89+
90+
- Set the `properties.osProfile.linuxConfiguration.disablePasswordAuthentication` property to `true`.
91+
92+
For example:
93+
94+
```bicep
95+
resource linux 'Microsoft.Compute/virtualMachines@2024-03-01' = {
96+
name: name
97+
location: location
98+
identity: {
99+
type: 'SystemAssigned'
100+
}
101+
properties: {
102+
hardwareProfile: {
103+
vmSize: 'Standard_D8d_v5'
104+
}
105+
osProfile: {
106+
computerName: name
107+
adminUsername: adminUsername
108+
linuxConfiguration: {
109+
disablePasswordAuthentication: true
110+
}
111+
}
112+
storageProfile: {
113+
imageReference: {
114+
publisher: 'MicrosoftCblMariner'
115+
offer: 'Cbl-Mariner'
116+
sku: 'cbl-mariner-2-gen2'
117+
version: 'latest'
118+
}
119+
osDisk: {
120+
name: '${name}-disk0'
121+
caching: 'ReadWrite'
122+
createOption: 'FromImage'
123+
managedDisk: {
124+
storageAccountType: 'Premium_LRS'
125+
}
126+
}
127+
}
128+
networkProfile: {
129+
networkInterfaces: [
130+
{
131+
id: nic.id
132+
}
133+
]
134+
}
135+
}
136+
zones: [
137+
'1'
138+
]
139+
}
140+
```
141+
142+
## LINKS
143+
144+
- [SE:08 Hardening resources](https://learn.microsoft.com/azure/well-architected/security/harden-resources)
145+
- [Azure security baseline for Linux Virtual Machines](https://learn.microsoft.com/security/benchmark/azure/baselines/virtual-machines-linux-security-baseline)
146+
- [Detailed steps: Create and manage SSH keys for authentication to a Linux VM in Azure](https://learn.microsoft.com/azure/virtual-machines/linux/create-ssh-keys-detailed)
147+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.compute/virtualmachines)

0 commit comments

Comments
 (0)