5. Identity and Login
5. Identity and Login
← Previous: 4. Components | Index | Next: 6. Authorization Model →
5.1 One Door for Humans
The only way a person reaches a shell is az ssh arc → Entra sign-in (MFA enforced by Conditional Access) → Arc relay → AADSSHLoginForLinux. Azure issues a certificate that lives minutes; the user lands as their own account (saif@proficientnow.com), auto-created on first login. No public SSH port is required for humans; the Arc SSH service configuration carries port 22 over the relay.
This is the mechanism already documented in ovh-infra (docs/ssh-access.md, docs/arc-ssh-quickstart.md) and is unchanged. What changes is everything around it.
5.2 Two Azure Roles, Used Strictly
| Role | Meaning | Who holds it | How |
|---|---|---|---|
| Virtual Machine User Login | may log in; no sudo | every tiered human, per class | active assignment to the tier groups of that class, declared in Terraform |
| Virtual Machine Administrator Login | full sudo (extension adds the user to aad_admins) | nobody permanently | PIM-eligible assignment on pn-host-admin only |
Rules (Invariants 2 and 3): assignments only to Entra groups; only via Terraform; no direct user assignments. The RG-scoped POL-Developer → Administrator Login grant is retired; today's direct grants on uat and ERP are migrated into groups and removed (Section 11).
5.2.1 PIM policy for pn-host-admin
| Setting | Value |
|---|---|
| Assignment type | Eligible only |
| Maximum activation | 4 hours (8 hours permitted for a declared maintenance window) |
| Activation requirements | MFA + written justification |
| Approval | Required on the prod class; second approver defined so an incident is never blocked on one person |
| Notification | Every activation posted to Sentinel and #infra |
Within an active window sudo is password-less (aad_admins); there are no repeated prompts. Entra users have no local password, so all sudo in this design is NOPASSWD by construction.
5.3 Keys and Passwords Cease to Be a Login Method
On every host (Ansible, extending the host-baseline sshd floor):
| Control | Setting |
|---|---|
| Password authentication | off (already) |
| Keyboard-interactive | off (already) |
| Root login | prohibit-password (already) — root reachable only by the break-glass key |
| Human accounts | no authorized_keys path at all; only the Arc certificate handler authenticates them |
su | disabled for all accounts via pam_wheel with an empty wheel group (Invariant 5) |
Shared mfaizan key and personal keys | removed last, after acceptance (Section 11) |
5.4 Automation Identities Are Untouched
Ansible, Terraform, the contabo-onboarding key, k8s join keys and per-node bootstrap keys are non-human identities. They are out of this RFC's scope (RFC-WORKLOAD-IDENTITY-0001) but explicitly preserved, listed in the access-map, and never shared with a human account. The host-baseline rule "no per-host local users" is refined to "no per-host human users".
5.5 Break-Glass
Exactly one root key per host, held in Azure Key Vault (the existing ovh_key / contabo_key / per-node onprem-*-ssh-privkey model). On Proxmox nodes it lives in node-local authorized_keys2 because the ordinary authorized_keys is a symlink into pmxcfs and is absent whenever the cluster is down. Any use fires a Sentinel alert (sshd root publickey acceptance + auditd) and requires the retrospective incident STD-IDENT-001 §D mandates. Rotated whenever anyone who could retrieve it leaves (Invariant 11). A deliberate drill proves the alert before cutover (Section 11).
5.6 Every Login Is Evidence
sshd auth events and Entra sign-in logs from every host land in Sentinel (Section 10), so "who logged in where, when, with MFA" is a query — the attribution that Problem 1 was about.
Document Navigation
| Previous | Index | Next |
|---|---|---|
| ← 4. Components | Table of Contents | 6. Authorization Model → |
End of Section 5