Skip to content

fix(azurelinux-release): harden cloud ssh defaults - #18442

Draft
Tobias Brick (tobiasb-ms) wants to merge 1 commit into
4.0from
tobiasb-ms/cis-sshd-hardening
Draft

fix(azurelinux-release): harden cloud ssh defaults#18442
Tobias Brick (tobiasb-ms) wants to merge 1 commit into
4.0from
tobiasb-ms/cis-sshd-hardening

Conversation

@tobiasb-ms

Copy link
Copy Markdown
Contributor

Summary

  • add an SSH server policy drop-in owned by azurelinux-release-cloud
  • configure access restrictions, the login banner, authentication limits, and unauthenticated connection limits for CIS controls 5.1.4, 5.1.5, 5.1.13, 5.1.16, and 5.1.17
  • restrict SSH MAC algorithms to SHA-2 variants for CIS control 5.1.15

Testing

  • built azurelinux-release successfully with azldev comp build -p azurelinux-release
  • verified the installed file is owned by azurelinux-release-cloud and sshd -t accepts the configuration
  • verified all six effective settings with sshd -T in a mock chroot
  • installed the updated package on an Azure VM and reran the CIS Azure Linux 4 Level 1 Server benchmark; all six targeted controls passed

Configure the Azure Linux cloud variant to satisfy CIS SSH access, banner, authentication, connection, and MAC requirements.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: ba5f8625-80e3-4137-9482-a9bc582c9e99
Copilot AI balanced review requested due to automatic review settings August 14, 2026 19:13

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Hardens SSH defaults for Azure Linux cloud images to satisfy targeted CIS controls.

Changes:

  • Adds cloud-specific SSH access, authentication, banner, MAC, and connection limits.
  • Packages the policy in azurelinux-release-cloud.
  • Updates the release, rendered output, and component lock.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file
File Description
base/comps/azurelinux-release/30-azurelinux-cis.conf Defines cloud SSH hardening policy.
base/comps/azurelinux-release/azurelinux-release.spec Packages the policy and bumps the release.
specs/a/azurelinux-release/30-azurelinux-cis.conf Contains the rendered policy.
specs/a/azurelinux-release/azurelinux-release.spec Contains the updated rendered spec.
locks/azurelinux-release.lock Refreshes the component fingerprint.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants