Back to Checks
openstack

Compute instances use SSH key-based authentication

compute_instance_key_based_authentication
Service: computeSeverity: high
OfficialBuilt-inVerified
Categories:identity-accessencryption
Resource Type:OS::Nova::Server

OpenStack compute instances (VMs) are evaluated to verify that SSH key-based authentication is configured by checking for an assigned keypair. Password-based authentication is vulnerable to brute-force attacks, credential stuffing, and phishing. SSH keys provide cryptographic authentication resistant to these attacks.

Prowler logoProwlerprowler-provider-openstack

Risk

Instances without SSH key-based authentication are vulnerable to brute-force password attacks, credential stuffing, and password reuse. Attackers can test common passwords, intercept credentials, or exploit leaked passwords from other breaches. Successful SSH access enables malware injection, lateral movement, privilege escalation, and data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks compute_instance_key_based_authentication

Recommendation

Always use SSH keys instead of passwords for instance authentication. Generate keys with strong algorithms (RSA 4096-bit, Ed25519). Protect private keys with passphrases and store securely. Disable password authentication in sshd_config. Rotate keypairs periodically and revoke old keys. Use bastion hosts or VPN for SSH access instead of direct internet exposure.

Remediation

CLI

chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys
sudo systemctl restart sshd
ssh -i ~/.ssh/private_key username@instance_ip

Terraform

# Terraform: ensure compute instance uses SSH key-based authentication

# Create or import keypair
resource "openstack_compute_keypair_v2" "keypair" {
  name       = "production-keypair"
  public_key = file("~/.ssh/id_rsa.pub")
}

resource "openstack_compute_instance_v2" "instance" {
  name            = "secure-instance"
  image_id        = var.image_id
  flavor_id       = var.flavor_id
  # Critical: attach keypair for SSH key-based authentication
  key_pair        = openstack_compute_keypair_v2.keypair.name
  security_groups = ["default"]

  network {
    name = var.network_name
  }

  # Optional: use cloud-init to enforce key-only authentication
  user_data = <<-EOF
    #cloud-config
    ssh_pwauth: false
    disable_root: true
  EOF
}

Other

1Navigate to **Compute > Instances > Launch Instance**
2In **Key Pair** tab, select existing keypair or create new one
3Launch instance with keypair attached

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.compute.compute_client import compute_client


class compute_instance_key_based_authentication(Check):
    """Ensure compute instances use SSH key-based authentication instead of passwords."""

    def execute(self) -> List[CheckReportOpenStack]:
        findings: List[CheckReportOpenStack] = []

        for instance in compute_client.instances:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=instance)
            if instance.key_name:
                report.status = "PASS"
                report.status_extended = f"Instance {instance.name} ({instance.id}) is configured with SSH key-based authentication (keypair: {instance.key_name})."
            else:
                report.status = "FAIL"
                report.status_extended = f"Instance {instance.name} ({instance.id}) does not have SSH key-based authentication configured (no keypair assigned)."

            findings.append(report)

        return findings

References