In the myDRE environment, direct SSH access to virtual machines (VMs) is blocked for security, technical, and compliance reasons. Instead, users must connect through Azure Bastion, a secure way to access their VMs. Here’s why this approach is necessary:
Technical Limitations
- No Public IP Addresses: Linux VMs in myDRE do not have public IP addresses. This means they cannot be reached directly from external networks without a secure way like Bastion.
- Firewall Protection: Direct SSH access could bypass firewall settings. SSH has features like reverse tunneling, which might allow unintended data transfers out of the secure network.
Security Risks
- Data Leaks: SSH supports features like port forwarding and tunneling, which could be used to move data out of the controlled myDRE environment. Additionally, direct SSH connections allow unrestricted access to the clipboard, enabling users to copy and paste data freely. This form of data transfer cannot be logged or audited, posing a significant security risk.
- Brute-Force Attacks: Open SSH ports are common targets for hackers who try to guess passwords repeatedly. If multiple users share a public IP, the risk of attack increases.
- Misconfigurations: Users with direct SSH access could unintentionally change security settings, making the system vulnerable.
Compliance with Security Standards (ISO 27001)
- Audit and Monitoring: Bastion records all SSH sessions for tracking and ensures users log in with myDRE credentials, preventing unauthorized access.
Read more:
- Security Manifesto
- Copying and Pasting in myDRE: Easy or Safe?