SSH and RDP access in Azure - Mini Project: Build & Apply

SSH and RDP Access Setup on Azure VM

📖 Scenario: You are setting up a virtual machine (VM) on Microsoft Azure. You want to allow secure remote access to this VM using SSH for Linux and RDP for Windows. This will let users connect safely from their computers to the VM.

🎯 Goal: Create Linux and Windows Azure VMs with network security rules that allow SSH access on port 22 and RDP access on port 3389.

📋 What You'll Learn

Create a resource group named myResourceGroup in eastus region

Create a virtual network named myVnet with subnet mySubnet

Create a network security group named myNSG with inbound rules for SSH (port 22) and RDP (port 3389)

Create network interfaces myNIC and myWinNIC attached to mySubnet and myNSG

Create a VM named myVM using UbuntuLTS for SSH access with myNIC and a VM named myWinVM using Win2019Datacenter for RDP access with myWinNIC

💡 Why This Matters

🌍 Real World

Setting up secure remote access to cloud virtual machines is essential for managing servers and applications remotely.

💼 Career

Cloud engineers and system administrators often configure network security and remote access to ensure safe and controlled connectivity to cloud resources.

1

Create Resource Group and Virtual Network

Create a resource group called myResourceGroup in the eastus region. Then create a virtual network called myVnet with address prefix 10.0.0.0/16 and a subnet called mySubnet with address prefix 10.0.1.0/24 inside myResourceGroup.

Azure

# Your code here to create resource group and virtual network

Hint

Use az group create to make the resource group and az network vnet create to make the virtual network with subnet.

2

Create Network Security Group with SSH and RDP Rules

Create a network security group called myNSG in myResourceGroup. Add an inbound security rule named AllowSSH to allow TCP traffic on port 22 from any source. Add another inbound rule named AllowRDP to allow TCP traffic on port 3389 from any source.

Azure

az group create --name myResourceGroup --location eastus
az network vnet create --resource-group myResourceGroup --name myVnet --address-prefix 10.0.0.0/16 --subnet-name mySubnet --subnet-prefix 10.0.1.0/24
# Your code here to create NSG and add SSH and RDP rules

Hint

Use az network nsg create to make the NSG and az network nsg rule create to add rules for ports 22 and 3389.

3

Create Network Interface with NSG Attached

Create a network interface called myNIC in myResourceGroup attached to the subnet mySubnet of myVnet. Attach the network security group myNSG to this network interface.

Azure

az group create --name myResourceGroup --location eastus
az network vnet create --resource-group myResourceGroup --name myVnet --address-prefix 10.0.0.0/16 --subnet-name mySubnet --subnet-prefix 10.0.1.0/24
az network nsg create --resource-group myResourceGroup --name myNSG
az network nsg rule create --resource-group myResourceGroup --nsg-name myNSG --name AllowSSH --protocol Tcp --direction Inbound --priority 1000 --source-address-prefixes '*' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 22 --access Allow
az network nsg rule create --resource-group myResourceGroup --nsg-name myNSG --name AllowRDP --protocol Tcp --direction Inbound --priority 1001 --source-address-prefixes '*' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 3389 --access Allow
# Your code here to create network interface with NSG attached

Hint

Use az network nic create with --network-security-group myNSG to attach the NSG.

4

Create Virtual Machine with SSH and RDP Access

Create a second network interface myWinNIC in myResourceGroup attached to mySubnet of myVnet and myNSG. Create a VM myVM using myNIC and UbuntuLTS image for SSH. Create myWinVM using myWinNIC and Win2019Datacenter image for RDP. Use azureuser as admin username, generate SSH keys for Linux, and set password YourP@ssw0rd123! for Windows.

Azure

az group create --name myResourceGroup --location eastus
az network vnet create --resource-group myResourceGroup --name myVnet --address-prefix 10.0.0.0/16 --subnet-name mySubnet --subnet-prefix 10.0.1.0/24
az network nsg create --resource-group myResourceGroup --name myNSG
az network nsg rule create --resource-group myResourceGroup --nsg-name myNSG --name AllowSSH --protocol Tcp --direction Inbound --priority 1000 --source-address-prefixes '*' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 22 --access Allow
az network nsg rule create --resource-group myResourceGroup --nsg-name myNSG --name AllowRDP --protocol Tcp --direction Inbound --priority 1001 --source-address-prefixes '*' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 3389 --access Allow
az network nic create --resource-group myResourceGroup --name myNIC --vnet-name myVnet --subnet mySubnet --network-security-group myNSG
# Your code here to create network interface myWinNIC and VMs using myNIC and myWinNIC

Hint

First, use az network nic create to create myWinNIC like myNIC. Then az vm create with --nics myNIC --image UbuntuLTS --generate-ssh-keys for SSH VM and --nics myWinNIC --image Win2019Datacenter --admin-password for RDP VM.

Practice

1. Which port does SSH use to connect securely to a Linux virtual machine in Azure?

easy

A. Port 3389

B. Port 22

C. Port 80

D. Port 443

Solution

1. Step 1: Identify SSH default port

   SSH (Secure Shell) uses port 22 by default to connect securely to Linux machines.

2. Step 2: Compare with other ports

   Port 3389 is used by RDP, port 80 is for HTTP, and port 443 is for HTTPS, so they are incorrect for SSH.

3. Final Answer:

   Port 22 -> Option B

4. Quick Check:

   SSH = Port 22 [OK]

Hint: SSH always uses port 22 for Linux access [OK]

Common Mistakes:

• Confusing SSH port with RDP port
• Using HTTP or HTTPS ports for SSH
• Assuming SSH uses a random port

2. Which of the following is the correct syntax to open port 3389 for RDP access in an Azure Network Security Group (NSG)?

easy

A. Allow inbound TCP on port 3389

B. Allow inbound TCP on port 22

C. Allow outbound UDP on port 3389

D. Allow inbound UDP on port 22

Solution

1. Step 1: Identify RDP port and protocol

   RDP uses TCP protocol on port 3389 for Windows remote desktop connections.

2. Step 2: Match correct NSG rule syntax

   Allowing inbound TCP on port 3389 opens RDP access. Other options use wrong ports or protocols.

3. Final Answer:

   Allow inbound TCP on port 3389 -> Option A

4. Quick Check:

   RDP = TCP 3389 inbound [OK]

Hint: RDP always needs inbound TCP on port 3389 [OK]

Common Mistakes:

• Using UDP instead of TCP
• Opening wrong port 22 for RDP
• Setting outbound instead of inbound rules

3. Given this Azure CLI command to open SSH access, what will it do?

az network nsg rule create --resource-group MyResourceGroup --nsg-name MyNSG --name AllowSSH --protocol Tcp --direction Inbound --priority 1000 --source-address-prefixes '*' --source-port-ranges '*' --destination-address-prefixes '*' --destination-port-ranges 22 --access Allow

medium

A. Allows inbound TCP traffic on port 22 from any source

B. Blocks inbound TCP traffic on port 22 from any source

C. Allows outbound TCP traffic on port 22 to any destination

D. Allows inbound UDP traffic on port 22 from any source

Solution

1. Step 1: Analyze command parameters

   The command creates an NSG rule named AllowSSH allowing inbound TCP traffic on port 22 from any source to any destination.

2. Step 2: Confirm traffic direction and protocol

   Direction is inbound, protocol is TCP, port is 22, and access is Allow, so it opens SSH access.

3. Final Answer:

   Allows inbound TCP traffic on port 22 from any source -> Option A

4. Quick Check:

   Inbound TCP 22 allowed = SSH access [OK]

Hint: Inbound TCP 22 with Allow opens SSH [OK]

Common Mistakes:

• Confusing inbound with outbound
• Using UDP instead of TCP
• Misreading port number

4. You tried to connect to a Windows VM via RDP but the connection timed out. Which of these is the most likely cause based on NSG rules?

medium

A. NSG allows inbound TCP on port 3389

B. NSG allows inbound UDP on port 22

C. NSG blocks inbound TCP on port 3389

D. NSG allows outbound TCP on port 3389

Solution

1. Step 1: Understand RDP connection requirements

   RDP requires inbound TCP access on port 3389 to allow remote desktop connections.

2. Step 2: Identify blocking rule

   If NSG blocks inbound TCP on port 3389, the connection will time out because traffic is denied.

3. Final Answer:

   NSG blocks inbound TCP on port 3389 -> Option C

4. Quick Check:

   Blocked inbound TCP 3389 causes timeout [OK]

Hint: Blocked inbound TCP 3389 causes RDP timeout [OK]

Common Mistakes:

• Confusing inbound with outbound rules
• Using wrong port for RDP
• Assuming UDP is needed for RDP

5. You want to secure SSH access to your Linux VM in Azure so only your office IP (203.0.113.5) can connect. Which NSG rule configuration is best?

hard

A. Allow inbound TCP on port 22 from source 0.0.0.0/0

B. Allow inbound TCP on port 3389 from source 203.0.113.5/32

C. Allow inbound UDP on port 22 from source 203.0.113.5/32

D. Allow inbound TCP on port 22 from source 203.0.113.5/32

Solution

1. Step 1: Identify SSH port and protocol

   SSH uses TCP on port 22, so the rule must allow TCP on port 22.

2. Step 2: Restrict source IP to office IP

   To secure access, restrict source to the office IP with /32 mask for a single IP.

3. Step 3: Exclude incorrect options

   Allow inbound TCP on port 22 from source 0.0.0.0/0 allows all IPs (not secure), Allow inbound UDP on port 22 from source 203.0.113.5/32 uses UDP (wrong protocol), Allow inbound TCP on port 3389 from source 203.0.113.5/32 uses RDP port (wrong service).

4. Final Answer:

   Allow inbound TCP on port 22 from source 203.0.113.5/32 -> Option D

5. Quick Check:

   Restrict SSH TCP 22 to office IP [OK]

Hint: Restrict SSH port 22 TCP to your IP only [OK]

Common Mistakes:

• Allowing all IPs instead of specific IP
• Using UDP instead of TCP
• Opening wrong port for SSH