Terraform创建Azure VM可SSH，手动同配置VM无法SSH求助

Terraform版本信息 #

Terraform v1.1.9
provider registry.terraform.io/hashicorp/azurerm v3.67.0

用于创建VM的Terraform代码 #

provider "azurerm" {
    
  features {}
}

resource "azurerm_resource_group" "rg" {
  name     = "myResourceGroup"
  location = "East US"
}

resource "azurerm_virtual_network" "vnet" {
  name                = "myVNet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
}

resource "azurerm_subnet" "subnet" {
  name                 = "mySubnet"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes       = ["10.0.1.0/24"]
}

resource "azurerm_public_ip" "public_ip" {
  name                = "myPublicIP"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  allocation_method   = "Static"
}

resource "azurerm_network_interface" "nic" {
  name                      = "myNIC"
  location                  = azurerm_resource_group.rg.location
  resource_group_name       = azurerm_resource_group.rg.name

  ip_configuration {
    name                          = "myNICConfig"
    subnet_id                     = azurerm_subnet.subnet.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.public_ip.id
  }
}

resource "azurerm_virtual_machine" "vm" {
  name                  = "myVM"
  location              = azurerm_resource_group.rg.location
  resource_group_name   = azurerm_resource_group.rg.name
  network_interface_ids = [azurerm_network_interface.nic.id]
  vm_size               = "Standard_B1s"
  delete_os_disk_on_termination = true
  delete_data_disks_on_termination = true

  storage_image_reference {
    publisher = "Canonical"
    offer     = "UbuntuServer"
    sku       = "16.04-LTS"
    version   = "latest"
  }

  os_profile {
    computer_name  = "myvm"
    admin_username = "ihateyouguys"
    admin_password = ""
  }
  os_profile_linux_config {
    disable_password_authentication = false
  }
  storage_os_disk {
    name              = "myOsDisk"
    caching           = "ReadWrite"
    create_option     = "FromImage"
  }


  tags = {
    environment = "test"
  }
}

问题描述 #

使用上述Terraform代码创建的Azure虚拟机可正常通过SSH登录，但手动创建配置完全相同（两者均未关联NSG）的虚拟机却无法SSH访问，已逐一对比配置仍未找到原因，请求协助排查解决。

排查要点 #

• 默认NSG自动绑定：
  Azure门户手动创建VM时，默认会自动生成一个NSG并关联到NIC或子网，即使未手动选择。检查手动创建VM的NIC/子网是否绑定了默认NSG，查看其入站规则，确认是否允许22端口的流量。若存在该NSG，添加允许SSH（TCP 22）入站的规则即可。
• SSH服务配置差异：
  通过Azure门户的串行控制台登录手动创建的VM，检查/etc/ssh/sshd_config中的配置：
  • 确认PasswordAuthentication设为yes（Terraform代码显式关闭了密码认证禁用）
  • 确认PermitRootLogin或AllowUsers未限制指定admin用户登录
    修改后重启sshd服务：sudo systemctl restart sshd
• Admin用户一致性：
  确认手动创建VM时使用的admin用户名与Terraform代码中的ihateyouguys完全一致，不同用户名可能存在SSH登录权限限制。
• VM内部防火墙：
  检查手动创建VM的系统防火墙状态：
  • 执行sudo ufw status查看ufw规则，若开启且未允许22端口，添加规则：sudo ufw allow 22
  • 执行sudo iptables -L查看iptables规则，确认无拒绝22端口的规则
• 公共IP配置：
  确认手动创建VM的公共IP为静态分配（与Terraform代码一致），动态IP可能存在分配延迟或解析问题；同时检查公共IP是否正确关联到NIC的IP配置。

内容的提问来源于stack exchange，提问作者Aniruddha Kulkarni