Ensure Virtual Machine Uses SSH Key Pair Authentication

Sign in to your OpenStack Console.

Navigate to Project > Compute > Instances.

Click on the name of the instance that you want to examine.

Select the Overview tab and locate the Metadata section. Check the Key Name field. If the Key Name field shows None, the selected virtual machine is not configured to use SSH key pair authentication.

Repeat steps no. 3 and 4 for each virtual machine deployed within the current OpenStack project.

Run server list command (Windows/macOS/Linux) with output format options to list the ID and name of each virtual machine available in the current OpenStack project:

openstack server list \
  --format json \
  --column ID \
  --column Name

The command output should return the requested virtual machine identifiers and names:

[
  {
    "ID": "11111111-2222-3333-4444-555555555555",
    "Name": "example-vm-001"
  },
  {
    "ID": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
    "Name": "example-vm-002"
  }
]

Run server show command (Windows/macOS/Linux) with the ID of the virtual machine that you want to examine as the identifier parameter, to describe the key pair configuration for the selected instance:

openstack server show 11111111-2222-3333-4444-555555555555 \
  --format json \
  --column key_name

The command output should return the requested key pair configuration:

{
  "key_name": null
}

If the server show command output returns null or an empty value for key_name, as shown in the example above, the selected virtual machine is not configured to use SSH key pair authentication and is therefore not compliant.

Repeat steps no. 3 and 4 for each virtual machine available within the current OpenStack project.

Sign in to your OpenStack Console.

Navigate to Project > Compute > Key Pairs.

If no suitable key pair exists, choose Create Key Pair or Import Public Key to add an SSH key pair to your project:

• For Create Key Pair: provide a unique Key Pair Name, select SSH Key as the key type, and choose Create Key Pair. Download and securely store the generated private key file (.pem).
• For Import Public Key: provide a unique Key Pair Name, select SSH Key as the key type, paste your existing public key in the Public Key field, and choose Import Key Pair.

Navigate to Project > Compute > Instances and choose Launch Instance to create a new virtual machine with the following configuration:

1. For Details, provide an instance name and select the target availability zone.
2. For Source, select the same image used by the non-compliant instance.
3. For Flavor, select the same flavor used by the non-compliant instance.
4. For Networks, configure the same network settings used by the non-compliant instance.
5. For Security Groups, apply the same security groups used by the non-compliant instance.
6. For Key Pair, select the key pair created or imported in step no. 3.
7. Choose Launch Instance to create the new virtual machine.

After verifying the new instance is running correctly, terminate the non-compliant instance by selecting it on the Instances page, choosing Actions, and selecting Delete Instance.

Run keypair list command (Windows/macOS/Linux) to list the SSH key pairs available in the current OpenStack project:

openstack keypair list \
  --format json \
  --column Name \
  --column Type

The command output should return the available key pairs:

[
  {
    "Name": "my-ssh-keypair",
    "Type": "ssh"
  }
]

If no suitable key pair exists, run the keypair create command to generate a new one and save the private key. On macOS/Linux, also restrict the file permissions so that ssh will accept the key:

openstack keypair create my-ssh-keypair \
  --private-key my-ssh-keypair.pem
chmod 600 my-ssh-keypair.pem

On Windows, use icacls to restrict access to the private key file instead:

openstack keypair create my-ssh-keypair \
  --private-key my-ssh-keypair.pem
icacls my-ssh-keypair.pem /inheritance:r /grant:r "%USERNAME%:R"

Run server show command (Windows/macOS/Linux) with the ID of the non-compliant instance to collect its current configuration details:

openstack server show 11111111-2222-3333-4444-555555555555 \
  --format json

The command output should return the instance configuration. Note the values for image, flavor, networks, and security_groups to use when creating the replacement instance.

Run server create command (Windows/macOS/Linux) to launch a new virtual machine using the same configuration as the non-compliant instance but with a key pair assigned:

openstack server create \
  --image aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
  --flavor cirros256 \
  --network example-network \
  --security-group custom-security-group \
  --key-name my-ssh-keypair \
  --format json \
  example-vm-001-remediated

The command output should return the new instance configuration. Verify that the key_name field shows the assigned key pair name and that the status field shows BUILD (the instance is being provisioned).

After verifying that the new instance is running and accessible using the SSH key pair, run server delete command to terminate the non-compliant instance:

openstack server delete 11111111-2222-3333-4444-555555555555

Repeat steps no. 3 – 7 for each non-compliant virtual machine available within the current OpenStack project.