You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/bastion/connect-vm-native-client-linux.md
+58-28Lines changed: 58 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,58 +5,88 @@ description: Learn how to connect to a VM from a Linux computer by using Bastion
5
5
author: cherylmc
6
6
ms.service: bastion
7
7
ms.topic: how-to
8
-
ms.date: 06/12/2023
8
+
ms.date: 06/23/2023
9
9
ms.author: cherylmc
10
10
---
11
11
12
12
# Connect to a VM using Bastion and a Linux native client
13
13
14
-
This article helps you connect to a VM in the VNet using the native client (SSH or RDP) on your local computer using the **az network bastion tunnel** command. The native client feature lets you connect to your target VMs via Bastion using Azure CLI, and expands your sign-in options to include local SSH key pair and Azure Active Directory (Azure AD). For more information and steps to configure Bastion for native client connections, see [Configure Bastion for native client connections](native-client.md). Connections via native client require the Bastion Standard SKU.
14
+
This article helps you connect via Azure Bastion to a VM in VNet using the native client on your local Linux computer. The native client feature lets you connect to your target VMs via Bastion using Azure CLI, and expands your sign-in options to include local SSH key pair and Azure Active Directory (Azure AD). For more information and steps to configure Bastion for native client connections, see [Configure Bastion for native client connections](native-client.md). Connections via native client require the Bastion Standard SKU.
15
15
16
16
:::image type="content" source="./media/native-client/native-client-architecture.png" alt-text="Diagram shows a connection via native client." lightbox="./media/native-client/native-client-architecture.png":::
17
17
18
-
After you've configured Bastion for native client support, you can connect to a VM using the **az network bastion tunnel** command. When you use this command, youcan do the following:
18
+
After you've configured Bastion for native client support, you can connect to a VM using a native Linux client. The method you use to connect depends on both the client you're connecting from, and the VM you're connecting to. The following list shows some of the available ways you can connect from a Linux native client. See [Connect to VMs](native-client.md#connect) for the full list showing available client connection/feature combinations.
19
19
20
-
* Use native clients on *non*-Windows local computers (example: a Linux computer).
21
-
* Use the native client of your choice. (This includes the Windows native client.)
22
-
* Connect using SSH or RDP. (The bastion tunnel doesn't relay web servers or hosts.)
23
-
* Set up concurrent VM sessions with Bastion.
24
-
*[Upload files](vm-upload-download-native.md#tunnel-command) to your target VM from your local computer. File download from the target VM to the local client is currently not supported for this command.
20
+
* Connect to a Linux VM using **az network bastion ssh**.
21
+
* Connect to a Windows VM using **az network bastion tunnel**.
22
+
* Connect to any VM using **az network bastion tunnel**.
23
+
*[Upload files](vm-upload-download-native.md#tunnel-command) to your target VM over SSH using **az network bastion tunnel**. File download from the target VM to the local client is currently not supported for this command.
25
24
26
-
Limitations:
27
-
28
-
* Signing in using an SSH private key stored in Azure Key Vault isn’t supported with this feature. Before signing in to your Linux VM using an SSH key pair, download your private key to a file on your local machine.
Verify that the following roles and ports are configured in order to connect to the VM.
38
32
39
33
[!INCLUDE [roles and ports](../../includes/bastion-native-roles-ports.md)]
40
34
41
-
## <aname="connect-tunnel"></a>Connect to a VM
35
+
## <aname="ssh"></a>Connect to a Linux VM
42
36
43
-
This section helps you connect to your virtual machine from native clients on *non*-Windows local computers (example: Linux) using the **az network bastion tunnel** command. You can also connect using this method from a Windows computer. This is helpful when you require an SSH connection and want to upload files to your VM. The bastion tunnel supports RDP/SSH connection, but doesn't relay web servers or hosts.
37
+
The steps in the following sections help you connect to a Linux VM from a Linux native client using the **az network bastion** command. This extension can be installed by running, `az extension add --name ssh`.
44
38
45
-
This connection supports file upload from the local computer to the target VM. For more information, see [Upload files](vm-upload-download-native.md).
39
+
When you connect using this command, file transfers aren't supported. If you want to upload files, connect using the [az network bastion tunnel](#tunnel) command instead.
If you’re signing in to an Azure AD login-enabled VM, use the following example. For more information, see [Azure Linux VMs and Azure AD](../active-directory/devices/howto-vm-sign-in-azure-ad-linux.md).
60
+
61
+
```azurecli
62
+
az network bastion ssh --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-resource-id "<VMResourceId or VMSSInstanceResourceId>" --auth-type "AAD"
If you’re signing in to your VM using a local username and password, use the following example. You’ll then be prompted for the password for the target VM.
68
+
69
+
```azurecli
70
+
az network bastion ssh --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-resource-id "<VMResourceId or VMSSInstanceResourceId>" --auth-type "password" --username "<Username>"
71
+
```
72
+
73
+
#### <aname="VM-IP"></a>SSH to a Linux VM IP address
74
+
75
+
You can connect to a VM private IP address instead of the resource ID. Be aware that Azure AD authentication, and custom ports and protocols aren't supported when using this type of connection. For more information about IP-based connections, see [Connect to a VM - IP address](connect-ip-address.md).
76
+
77
+
Using the `az network bastion` command, replace `--target-resource-id` with `--target-ip-address` and the specified IP address to connect to your VM. The following example uses --ssh-key for the authentication method.
Copy file name to clipboardExpand all lines: articles/bastion/connect-vm-native-client-windows.md
+60-53Lines changed: 60 additions & 53 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ description: Learn how to connect to a VM from a Windows computer by using Basti
5
5
author: cherylmc
6
6
ms.service: bastion
7
7
ms.topic: how-to
8
-
ms.date: 06/12/2023
8
+
ms.date: 06/23/2023
9
9
ms.author: cherylmc
10
10
---
11
11
@@ -15,16 +15,13 @@ This article helps you connect to a VM in the VNet using the native client (SSH
15
15
16
16
:::image type="content" source="./media/native-client/native-client-architecture.png" alt-text="Diagram shows a connection via native client." lightbox="./media/native-client/native-client-architecture.png":::
17
17
18
-
After you've configured Bastion for native client support, you can connect to a VM using the native Windows client. This lets you do the following:
18
+
After you've configured Bastion for native client support, you can connect to a VM using a native Windows client. The method you use to connect depends on both the client you're connecting from, and the VM you're connecting to. The following list shows some of the available ways you can connect from a Windows native client. See [Connect to VMs](native-client.md#connect) for the full list showing available client connection/feature combinations.
19
19
20
-
* Connect using SSH or RDP.
21
-
*[Upload and download files](vm-upload-download-native.md#rdp) over RDP.
22
-
* If you want to connect using SSH and need to upload files to your target VM, you can use the instructions for the [az network bastion tunnel](connect-vm-native-client-linux.md) command instead.
23
-
24
-
Limitations:
25
-
26
-
* Signing in using an SSH private key stored in Azure Key Vault isn’t supported with this feature. Before signing in to your Linux VM using an SSH key pair, download your private key to a file on your local machine.
27
-
* This feature isn't supported on Cloud Shell.
20
+
* Connect to a Windows VM using **az network bastion rdp**.
21
+
* Connect to a Linux VM using **az network bastion ssh**.
22
+
* Connect to a VM using **az network bastion tunnel**.
23
+
*[Upload and download files](vm-upload-download-native.md#rdp) over RDP.
24
+
* Upload files over SSH using **az network bastion tunnel**.
28
25
29
26
## <aname="prereq"></a>Prerequisites
30
27
@@ -36,60 +33,70 @@ Verify that the following roles and ports are configured in order to connect to
36
33
37
34
[!INCLUDE [roles and ports](../../includes/bastion-native-roles-ports.md)]
38
35
39
-
## <aname="connect-windows"></a>Connect to a Windows VM
36
+
## Connect to a VM
40
37
41
-
1. Sign in to your Azure account. If you have more than one subscription, select the subscription containing your Bastion resource.
42
-
43
-
```azurecli
44
-
az login
45
-
az account list
46
-
az account set --subscription "<subscription ID>"
47
-
```
38
+
The steps in the following sections help you connect to a VM from a Windows native client using the **az network bastion** command.
48
39
49
-
1. Sign in to your target Windows VM using one of the following example options. If you want to specify a custom port value, you should also include the field **--resource-port** in the sign-in command.
40
+
### <aname="connect-windows"></a>RDP to a Windows VM
50
41
51
-
**RDP:**
42
+
1. Sign in to your Azure account using `az login`. If you have more than one subscription, you can view them using `az account list` and select the subscription containing your Bastion resource using `az account set --subscription "<subscription ID>"`.
52
43
53
-
To connect via RDP, use the following command. You’ll then be prompted to input your credentials. You can use either a local username and password, or your Azure AD credentials. For more information, see [Azure Windows VMs and Azure AD](../active-directory/devices/howto-vm-sign-in-azure-ad-windows.md).
44
+
1.To connect via RDP, use the following example.
54
45
55
46
```azurecli
56
47
az network bastion rdp --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-resource-id "<VMResourceId>"
57
48
```
58
49
50
+
1. After running the command, you're prompted to input your credentials. You can use either a local username and password, or your Azure AD credentials. Once you sign in to your target VM, the native client on your computer opens up with your VM session via **MSTSC**.
51
+
59
52
> [!IMPORTANT]
60
-
> Remote connection to VMs that are joined to Azure AD is allowed only from Windows 10 or later PCs that are Azure AD registered (starting with Windows 10 20H1), Azure AD joined, or hybrid Azure AD joined to the *same* directory as the VM.
53
+
> Remote connection to VMs that are joined to Azure AD is allowed only from Windows 10 or later PCs that are Azure AD registered (starting with Windows 10 20H1), Azure AD joined, or hybrid Azure AD joined to the *same* directory as the VM.
61
54
62
-
**SSH:**
55
+
#### Specify authentication method
63
56
64
-
The extension can be installed by running, ```az extension add --name ssh```. To sign in using an SSH key pair, use the following example.
57
+
Optionally, you can also specify the authentication method as part of the command.
***Azure AD authentication:**`--auth-type "AAD"` For more information, see [Azure Windows VMs and Azure AD](../active-directory/devices/howto-vm-sign-in-azure-ad-windows.md).
69
60
70
-
Once you sign in to your target VM, the native client on your computer opens up with your VM session; **MSTSC** for RDP sessions, and **SSH CLI extension (az ssh)** for SSH sessions.
61
+
***User name and password:**`--auth-type "password" --username "<Username>"`
71
62
72
-
##<aname="connect-linux"></a>Connect to a Linux VM
63
+
#### Specify a custom port
73
64
74
-
1. Sign in to your Azure account. If you have more than one subscription, select the subscription containing your Bastion resource.
65
+
You can specify a custom port when you connect to a Windows VM via RDP.
75
66
76
-
```azurecli
77
-
az login
78
-
az account list
79
-
az account set --subscription "<subscription ID>"
80
-
```
67
+
One scenario where this could be especially useful would be connecting to a Windows VM via port 22. This is a potential workaround for the limitation with the *az network bastion ssh* command, which can't be used by a Windows native client to connect to a Windows VM.
68
+
69
+
To specify a custom port, include the field **--resource-port** in the sign-in command, as shown in the following example.
You can also connect to a VM private IP address, instead of the resource ID. Azure AD authentication, and custom ports and protocols aren't supported when using this type of connection. For more information about IP-based connections, see [Connect to a VM - IP address](connect-ip-address.md).
81
78
82
-
1. Sign in to your target Linux VM using one of the following example options. If you want to specify a custom port value, you should also include the field **--resource-port** in the sign-in command.
79
+
Using the `az network bastion` command, replace `--target-resource-id` with `--target-ip-address` and the specified IP address to connect to your VM.
80
+
81
+
```azurecli
82
+
az network bastion rdp --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-ip-address "<VMIPAddress>"
83
+
```
84
+
85
+
### <aname="connect-linux"></a>SSH to a Linux VM
86
+
87
+
1. Sign in to your Azure account using `az login`. If you have more than one subscription, you can view them using `az account list` and select the subscription containing your Bastion resource using `az account set --subscription "<subscription ID>"`.
88
+
89
+
1. Sign in to your target Linux VM using one of the following example options. If you want to specify a custom port value, include the field **--resource-port** in the sign-in command.
83
90
84
91
**Azure AD:**
85
92
86
93
If you’re signing in to an Azure AD login-enabled VM, use the following command. For more information, see [Azure Linux VMs and Azure AD](../active-directory/devices/howto-vm-sign-in-azure-ad-linux.md).
87
94
88
95
```azurecli
89
-
az network bastion ssh --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-resource-id "<VMResourceId or VMSSInstanceResourceId>" --auth-type "AAD"
96
+
az network bastion ssh --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-resource-id "<VMResourceId or VMSSInstanceResourceId>" --auth-type "AAD"
90
97
```
91
98
92
-
**SSH:**
99
+
**SSH key pair:**
93
100
94
101
The extension can be installed by running, ```az extension add --name ssh```. To sign in using an SSH key pair, use the following example.
95
102
@@ -105,25 +112,25 @@ Verify that the following roles and ports are configured in order to connect to
105
112
az network bastion ssh --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-resource-id "<VMResourceId or VMSSInstanceResourceId>" --auth-type "password" --username "<Username>"
106
113
```
107
114
108
-
1. Once you sign in to your target VM, the native client on your computer opens up with your VM session; **MSTSC** for RDP sessions, and **SSH CLI extension (az ssh)** for SSH sessions.
115
+
1. Once you sign in to your target VM, the native client on your computer opens up with your VM session using **SSH CLI extension (az ssh)**.
109
116
110
-
## <a name="connect-IP"></a>Connect to VM via IP Address
You can also connect to a VM private IP address, instead of the resource ID. Azure AD authentication, and custom ports and protocols aren't supported when using this type of connection. For more information about IP-based connections, see [Connect to a VM - IP address](connect-ip-address.md).
113
120
114
-
Use the following commands as examples:
121
+
Using the `az network bastion` command, replace `--target-resource-id` with `--target-ip-address` and the specified IP address to connect to your VM.
115
122
116
-
**RDP:**
117
-
118
-
```azurecli
119
-
az network bastion rdp --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-ip-address "<VMIPAddress>
0 commit comments