Export-AzSshConfig

Syntax

Export-AzSshConfig
      -ResourceGroupName <String>
      -Name <String>
      -ConfigFilePath <String>
      [-PublicKeyFile <String>]
      [-PrivateKeyFile <String>]
      [-UsePrivateIp]
      [-LocalUser <String>]
      [-Port <String>]
      [-ResourceType <String>]
      [-CertificateFile <String>]
      [-Overwrite]
      [-KeysDestinationFolder <String>]
      [-Force]
      [-DefaultProfile <IAzureContextContainer>]
      [<CommonParameters>]

Export-AzSshConfig
      -Ip <String>
      -ConfigFilePath <String>
      [-PublicKeyFile <String>]
      [-PrivateKeyFile <String>]
      [-LocalUser <String>]
      [-Port <String>]
      [-CertificateFile <String>]
      [-Overwrite]
      [-KeysDestinationFolder <String>]
      [-Force]
      [-DefaultProfile <IAzureContextContainer>]
      [<CommonParameters>]

Export-AzSshConfig
      -ResourceId <String>
      -ConfigFilePath <String>
      [-PublicKeyFile <String>]
      [-PrivateKeyFile <String>]
      [-UsePrivateIp]
      [-LocalUser <String>]
      [-Port <String>]
      [-CertificateFile <String>]
      [-Overwrite]
      [-KeysDestinationFolder <String>]
      [-Force]
      [-DefaultProfile <IAzureContextContainer>]
      [<CommonParameters>]

Description

The exported SSH configuration file can be used to connect to Azure Resources by client applications that support OpenSSH config and certificates. Applications such as git and rsync can use configuration file by setting the command to 'ssh -F /path/to/config'. For example: rsync -e 'ssh -F /path/to/config'. Users can create ssh config files that use Microsoft Entra ID issued certificates or local user credentials. Important note: When connecting to Azure Arc resources, this cmdlet requires the Az.Ssh.ArcProxy module to also be installed in the client machine. The cmdlet will attempt to install the module from the PowerShell Gallery, but the user also has the option to install it themselves. It is important that the user also has permission to execute the Proxy files in the Az.Ssh.ArcProxy module, or the connection will fail. You can find the Az.Ssh.ArcServer module in the PowerShell Gallery: https://aka.ms/PowerShellGallery-Az.Ssh.ArcProxy.

Examples

Example 1: Export a SSH configuration file for connecting to a resource using Microsoft Entra ID issued certificates for authentication.

Export-AzSshConfig -ResourceGroupName myRg -Name myMachine -ConfigFilePath ./sshconfig.config

When a -LocalUser is not supplied, the cmdlet will attempt to create a certificate to login using Microsoft Entra ID. This is currently only supported for resources running Linux OS. When using Microsoft Entra ID to login to resource, the Host name in the configuration entry will be "{resource group name}-{resource name}", or "{ip address}" for Azure VMs.

Example 2: Export a SSH configuration file for connecting to the Public Ip of an Azure Virtual Machine using Microsoft Entra ID issued certificates.

Export-AzSshConfig -Ip 1.2.3.4 -ConfigFilePath ./sshconfig.config

Example 3: Export a SSH configuration file for connecting to Local User on Azure Resource using SSH certificates for authentication

Export-AzSshConfig -ResourceGroupName myRg -Name myVm -LocalUser azureuser -CertificateFile ./cert -PrivateKeyFile ./id_rsa -ConfigFilePath ./sshconfig.config

When using local user credentials to login, the host name in the configuration entry will be "{resource group name}-{resource name}-{username}", or "{ip address}-{username}" for Azure VMs.

Example 4: Export a SSH configuration file for connecting to Local User on Azure Resource using SSH private key for authentication

Export-AzSshConfig -ResourceGroupName myRg -Name myVm -LocalUser azureuser -PrivateKeyFile ./id_rsa -ConfigFilePath ./sshconfig.config

Example 5: Export a SSH configuration file for connecting to Local User on Azure Resource using interactive username and password for authentication

Export-AzSshConfig -ResourceGroupName myRg -Name myVm -LocalUser azureuser -ConfigFilePath ./sshconfig.config

Example 6: Determine where generated keys and certificates for the certificate will the stored.

Export-AzSshConfig -ResourceGroupName myRg -Name myVm -KeysDestinationFolder /home/user/mykeys -ConfigFilePath ./sshconfig.config

Generated keys and certificates are, by default, stored in "az_ssh_config" directory in the same directory as the config file. The -KeysDestinationFolder parameter allows user to decide where the keys will be stored.

Example 7: Create a generic config for use with any Azure VM.

Export-AzSshConfig -Ip * -ConfigFilePath ./sshconfig.config

Example 8: Provide the Resource Type of the target.

Export-AzSshConfig -ResourceGroupName myRg -Name myVm -ResourceType Microsoft.Compute/virtualMachines -ConfigFilePath ./sshconfig.config

This parameter is useful when there is more than one supported resource with the same name in the Resource Group.

Parameters

-CertificateFile

-ConfigFilePath

-DefaultProfile

-Force

-Ip

-KeysDestinationFolder

-LocalUser

-Name

-Overwrite

-Port

-PrivateKeyFile

-PublicKeyFile

-ResourceGroupName

-ResourceId

-ResourceType

-UsePrivateIp

Inputs

String

Outputs

PSSshConfigEntry

Related Links

• SSH Access to Arzure Arc-enabled servers
• Troubleshoot SSH access to Azure Arc Enabled Servers
• Login to a Linux VM by using Microsoft Entra ID
• Install OpenSSH for Windows