github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/azure/compute/disable_password_authentication.go (about) 1 package compute 2 3 import ( 4 "github.com/khulnasoft-lab/defsec/internal/rules" 5 "github.com/khulnasoft-lab/defsec/pkg/providers" 6 "github.com/khulnasoft-lab/defsec/pkg/scan" 7 "github.com/khulnasoft-lab/defsec/pkg/severity" 8 "github.com/khulnasoft-lab/defsec/pkg/state" 9 ) 10 11 var CheckDisablePasswordAuthentication = rules.Register( 12 scan.Rule{ 13 AVDID: "AVD-AZU-0039", 14 Provider: providers.AzureProvider, 15 Service: "compute", 16 ShortCode: "disable-password-authentication", 17 Summary: "Password authentication should be disabled on Azure virtual machines", 18 Impact: "Using password authentication is less secure that ssh keys may result in compromised servers", 19 Resolution: "Use ssh authentication for virtual machines", 20 Explanation: `Access to virtual machines should be authenticated using SSH keys. Removing the option of password authentication enforces more secure methods while removing the risks inherent with passwords.`, 21 Links: []string{}, 22 Terraform: &scan.EngineMetadata{ 23 GoodExamples: terraformDisablePasswordAuthenticationGoodExamples, 24 BadExamples: terraformDisablePasswordAuthenticationBadExamples, 25 Links: terraformDisablePasswordAuthenticationLinks, 26 RemediationMarkdown: terraformDisablePasswordAuthenticationRemediationMarkdown, 27 }, 28 Severity: severity.High, 29 }, 30 func(s *state.State) (results scan.Results) { 31 for _, vm := range s.Azure.Compute.LinuxVirtualMachines { 32 if vm.Metadata.IsUnmanaged() { 33 continue 34 } 35 if vm.OSProfileLinuxConfig.DisablePasswordAuthentication.IsFalse() { 36 results.Add( 37 "Linux virtual machine allows password authentication.", 38 vm.OSProfileLinuxConfig.DisablePasswordAuthentication, 39 ) 40 } else { 41 results.AddPassed(&vm) 42 } 43 } 44 return 45 }, 46 )