Question

我需要获取具有不受限制的SSH的VM的列表。

我一直在浏览Azure Python SDK文档。有一个SshConfiguration class in the compute module，但仅包含有关公共密钥的信息。有一个不同的SshConfiguration class in the batch AI module可用于获取允许连接的公共IP列表，这正是我想要的。但是我没有使用批处理AI。

如何以编程方式获取我想要的信息？

Answer 1

您必须绕道而行，因为Compute模块中没有直接提供此信息的直接方法。

使用Compute和Network模块中的方法，我对以下脚本进行了编码，以列出具有不受限制的SSH访问的订阅中的所有VM，即列出了所有允许从Internet通过端口22访问VM的入站规则。

# Imports
from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.network import NetworkManagementClient
from azure.mgmt.compute import ComputeManagementClient

# Set subscription ID
SUBSCRIPTION_ID = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'


def get_credentials():
    credentials = ServicePrincipalCredentials(
        client_id='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
        secret='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
        tenant='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
    )

    return credentials


# Get credentials
credentials = get_credentials()

# Initialize management client
network_client = NetworkManagementClient(
    credentials,
    SUBSCRIPTION_ID
)

# Initialize management client
compute_client = ComputeManagementClient(
    credentials,
    SUBSCRIPTION_ID
)


def get_unrestricted_ssh_rules():

    print('\nListing all VMs in Subscription with unrestricted SSH access:')
    for vm in compute_client.virtual_machines.list_all():
        # Get the VM Resource Group name
        vm_rg_name = vm.id.split('/')[4]

        # Loop through NICs
        for nic in vm.network_profile.network_interfaces:
            # Get the NIC name and Resource Group
            nic_name = nic.id.split('/')[-1]
            nic_rg_name = nic.id.split('/')[4]

            # Get the associated NSG and its Resource Group
            nsg = network_client.network_interfaces.get(
                nic_rg_name, nic_name).network_security_group

            nsg_name = nsg.id.split('/')[-1]
            nsg_rg_name = nsg.id.split('/')[4]

            # Get the associated Security Rules
            for rule in network_client.security_rules.list(nsg_rg_name, nsg_name):
                # Conditions:
                # Rule direction: Inbound
                # Rule Access: Allow
                # Port: 22
                # Source Address Prefix: 'Internet' or '*'

                unrestricted = (rule.direction == 'Inbound' and rule.access == 'Allow' and ('22' in (rule.destination_port_ranges, rule.destination_port_range)
                                or rule.destination_port_range == '*') and (rule.source_address_prefix == '*' or rule.source_address_prefix == 'Internet'))
                # Print all the Inbound rules allowing access to the VM over port 22 from the Internet
                if unrestricted:
                    print "\nVM Name: ", vm.name, "\nResource Group Name: ", vm_rg_name, "\nRule Name: ", rule.name


# List all VMs in the Subscription with unrestricted SSH access
get_unrestricted_ssh_rules()

如果NSG是与子网而不是NIC关联的，则也可以对子网重复相同的操作。

参考：

希望这会有所帮助！

如何以编程方式找到具有不受限制的SSH连接的VM？

1 个答案: