SSH and RDP access in Azure - Commands & Configuration

Introduction

SSH and RDP let you connect to virtual machines in the cloud. SSH is for Linux machines and RDP is for Windows machines. They help you manage your servers remotely as if you were sitting in front of them.

When you want to securely connect to a Linux virtual machine to install software or check logs.

When you need to access a Windows virtual machine to use graphical tools or configure settings.

When you want to troubleshoot a server that is not responding to your application requests.

When you want to run commands or scripts directly on your cloud server.

When you need to transfer files securely between your computer and the cloud server.

Commands

This command creates a Linux virtual machine with SSH access enabled by generating SSH keys automatically.

Terminal

az vm create --resource-group example-rg --name example-linux-vm --image UbuntuLTS --admin-username azureuser --generate-ssh-keys

Expected Output

{

  "fqdns": "",

  "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/example-rg/providers/Microsoft.Compute/virtualMachines/example-linux-vm",

  "location": "eastus",

  "name": "example-linux-vm",

  "powerState": "VM running",

  "resourceGroup": "example-rg",

  "zones": ""

}

→

--generate-ssh-keys - Automatically creates SSH keys if none exist for secure login

→

--admin-username - Sets the username for SSH login

This command connects you to the Linux VM using SSH with the username azureuser.

Terminal

ssh [e-mail]

Expected Output

Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-1045-azure x86_64)



azureuser@example-linux-vm:~$

This command creates a Windows virtual machine with RDP access enabled using a username and password.

Terminal

az vm create --resource-group example-rg --name example-windows-vm --image Win2019Datacenter --admin-username azureuser --admin-password StrongP@ssw0rd123

Expected Output

{

  "fqdns": "",

  "id": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/example-rg/providers/Microsoft.Compute/virtualMachines/example-windows-vm",

  "location": "eastus",

  "name": "example-windows-vm",

  "powerState": "VM running",

  "resourceGroup": "example-rg",

  "zones": ""

}

→

--admin-password - Sets the password for RDP login

→

--admin-username - Sets the username for RDP login

This command opens port 3389 on the Windows VM to allow RDP connections.

Terminal

az vm open-port --resource-group example-rg --name example-windows-vm --port 3389

Expected Output

Network security group rule created successfully.

→

--port - Specifies the port number to open for RDP

This command opens the Remote Desktop Connection client to connect to the Windows VM using RDP.

Terminal

mstsc /v:example-windows-vm.eastus.cloudapp.azure.com

Expected Output

No output (command runs silently)

Key Concept

If you remember nothing else, remember: SSH is for secure command-line access to Linux VMs, and RDP is for graphical access to Windows VMs.

Common Mistakes

Trying to SSH into a Windows VM or RDP into a Linux VM.

SSH and RDP use different protocols and are designed for different operating systems.

Use SSH for Linux VMs and RDP for Windows VMs.

Not opening the correct network port (22 for SSH, 3389 for RDP) in the VM's firewall.

Without the port open, the connection will be blocked and fail.

Use Azure CLI commands to open the required ports before connecting.

Using weak or default passwords for RDP access.

Weak passwords can allow unauthorized access and compromise security.

Always use strong, unique passwords for RDP login.

Summary

Create Linux VMs with SSH keys for secure command-line access.

Create Windows VMs with username and password for RDP access.

Open the correct network ports to allow remote connections.

Use SSH command to connect to Linux VMs and RDP client to connect to Windows VMs.

Practice

1. Which port does SSH use to connect securely to a Linux virtual machine in Azure?

easy

A. Port 3389

B. Port 22

C. Port 80

D. Port 443

Solution

1. Step 1: Identify SSH default port

   SSH (Secure Shell) uses port 22 by default to connect securely to Linux machines.

2. Step 2: Compare with other ports

   Port 3389 is used by RDP, port 80 is for HTTP, and port 443 is for HTTPS, so they are incorrect for SSH.

3. Final Answer:

   Port 22 -> Option B

4. Quick Check:

   SSH = Port 22 [OK]

Hint: SSH always uses port 22 for Linux access [OK]

Common Mistakes:

• Confusing SSH port with RDP port
• Using HTTP or HTTPS ports for SSH
• Assuming SSH uses a random port

2. Which of the following is the correct syntax to open port 3389 for RDP access in an Azure Network Security Group (NSG)?

easy

A. Allow inbound TCP on port 3389

B. Allow inbound TCP on port 22

C. Allow outbound UDP on port 3389

D. Allow inbound UDP on port 22

Solution

1. Step 1: Identify RDP port and protocol

   RDP uses TCP protocol on port 3389 for Windows remote desktop connections.

2. Step 2: Match correct NSG rule syntax

   Allowing inbound TCP on port 3389 opens RDP access. Other options use wrong ports or protocols.

3. Final Answer:

   Allow inbound TCP on port 3389 -> Option A

4. Quick Check:

   RDP = TCP 3389 inbound [OK]

Hint: RDP always needs inbound TCP on port 3389 [OK]

Common Mistakes:

• Using UDP instead of TCP
• Opening wrong port 22 for RDP
• Setting outbound instead of inbound rules

3. Given this Azure CLI command to open SSH access, what will it do?

az network nsg rule create --resource-group MyResourceGroup --nsg-name MyNSG --name AllowSSH --protocol Tcp --direction Inbound --priority 1000 --source-address-prefixes '*' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 22 --access Allow

medium

A. Allows inbound TCP traffic on port 22 from any source

B. Blocks inbound TCP traffic on port 22 from any source

C. Allows outbound TCP traffic on port 22 to any destination

D. Allows inbound UDP traffic on port 22 from any source

Solution

1. Step 1: Analyze command parameters

   The command creates an NSG rule named AllowSSH allowing inbound TCP traffic on port 22 from any source to any destination.

2. Step 2: Confirm traffic direction and protocol

   Direction is inbound, protocol is TCP, port is 22, and access is Allow, so it opens SSH access.

3. Final Answer:

   Allows inbound TCP traffic on port 22 from any source -> Option A

4. Quick Check:

   Inbound TCP 22 allowed = SSH access [OK]

Hint: Inbound TCP 22 with Allow opens SSH [OK]

Common Mistakes:

• Confusing inbound with outbound
• Using UDP instead of TCP
• Misreading port number

4. You tried to connect to a Windows VM via RDP but the connection timed out. Which of these is the most likely cause based on NSG rules?

medium

A. NSG allows inbound TCP on port 3389

B. NSG allows inbound UDP on port 22

C. NSG blocks inbound TCP on port 3389

D. NSG allows outbound TCP on port 3389

Solution

1. Step 1: Understand RDP connection requirements

   RDP requires inbound TCP access on port 3389 to allow remote desktop connections.

2. Step 2: Identify blocking rule

   If NSG blocks inbound TCP on port 3389, the connection will time out because traffic is denied.

3. Final Answer:

   NSG blocks inbound TCP on port 3389 -> Option C

4. Quick Check:

   Blocked inbound TCP 3389 causes timeout [OK]

Hint: Blocked inbound TCP 3389 causes RDP timeout [OK]

Common Mistakes:

• Confusing inbound with outbound rules
• Using wrong port for RDP
• Assuming UDP is needed for RDP

5. You want to secure SSH access to your Linux VM in Azure so only your office IP (203.0.113.5) can connect. Which NSG rule configuration is best?

hard

A. Allow inbound TCP on port 22 from source 0.0.0.0/0

B. Allow inbound TCP on port 3389 from source 203.0.113.5/32

C. Allow inbound UDP on port 22 from source 203.0.113.5/32

D. Allow inbound TCP on port 22 from source 203.0.113.5/32

Solution

1. Step 1: Identify SSH port and protocol

   SSH uses TCP on port 22, so the rule must allow TCP on port 22.

2. Step 2: Restrict source IP to office IP

   To secure access, restrict source to the office IP with /32 mask for a single IP.

3. Step 3: Exclude incorrect options

   Allow inbound TCP on port 22 from source 0.0.0.0/0 allows all IPs (not secure), Allow inbound UDP on port 22 from source 203.0.113.5/32 uses UDP (wrong protocol), Allow inbound TCP on port 3389 from source 203.0.113.5/32 uses RDP port (wrong service).

4. Final Answer:

   Allow inbound TCP on port 22 from source 203.0.113.5/32 -> Option D

5. Quick Check:

   Restrict SSH TCP 22 to office IP [OK]

Hint: Restrict SSH port 22 TCP to your IP only [OK]

Common Mistakes:

• Allowing all IPs instead of specific IP
• Using UDP instead of TCP
• Opening wrong port for SSH