Setting adminPassword not effective; linux deployed in Azure Resource Manager - azure

Question

I'm using ARM templates to deploy linux machines. Inside of my Microsoft.Compute/virtualMachines deployment, I have properties including this (following the docs)
"osProfile": {
"computerName": "computer-name-here",
"adminUsername": "[parameters('AdminUserName')]",
"adminPassword": "password following rules here",
"linuxConfiguration": {
"disablePasswordAuthentication": false
}
"secrets": []
},
The problem is that login with that username and password doesn't work with the VM.
When the machine spins, then ssh user#host fails, saying public key authentication failed. When I use special flags to force asking for a password, same result.
When I check the automation script for the VM, I see that my properties came through, but adminPassword is missing. I assume they're removing that from the console for security, but the SSH client sure makes it look like it's ignoring my configured parameters and enabling ssh key only access.
Is username/password login possible using Azure, or have I missed something?
EDIT More details:
The way my osProfile is generated is via a template that does this: (note I'm prepending "password" to the username to make ultra sure the substitutions are correct)
"authConfig-sshpublickey": {
"adminUsername": "[concat('pubkey-',parameters('AdminUserName'))]",
"adminPassword": "",
"linuxConfiguration": {
"disablePasswordAuthentication": true,
"ssh": {
"publicKeys": [
{
"path": "[concat('/home/', parameters('AdminUserName'),'/.ssh/authorized_keys')]",
"keyData": "[parameters('AdminCredential')]"
}
]
}
}
},
"authConfig-password": {
"adminUsername": "[concat('password-',parameters('AdminUserName'))]",
"linuxConfiguration": null,
"adminPassword": "[parameters('AdminCredential')]"
},
"authConfig": "[variables(concat('authConfig-',parameters('AdminAuthType')))]"
Then I'm setting it in the VM like this:
"osProfile": {
"computerName": "[concat(variables('namePrefixes').vm, '-', copyIndex())]",
"adminUsername": "[variables('authConfig').adminUsername]",
"adminPassword": "[variables('authConfig').adminPassword]",
"linuxConfiguration": "[variables('authConfig').linuxConfiguration]"
},
Because at runtime I'm using AdminAuthType=password, it's taking that substitution.
I run the template, it sets up all of my infrastructure correctly, then I go into the Azure console, check the automation script for the resulting VMs, and I see this:
"osProfile": {
"computerName": "[parameters('extra stuff here')]",
"adminUsername": "password-myuser",
"linuxConfiguration": {
"disablePasswordAuthentication": false
},
"secrets": []
},
So, conclusions:
It is substituting on the basis of password auth
It's plugging in linuxConfiguration when I told it explicitly not to.
adminPassword isn't showing up in the automation script, but as said before I'm not sure if this is for security reasons, or it's never actually making it through.

Answer 1

The exact answer is yes, it's possible to log in via username/password on Azure. With the template you posted, you can just ignore the property "linuxConfiguration" and "secrets". The simple template can be just this:
"osProfile": {
"computerName": "[variables('vmName')]",
"adminUsername": "[parameters('adminUsername')]",
"adminPassword": "[parameters('adminPassword')]"
},
Without the property "linuxConfiguration" so that the ssh key will not be configured. And the whole template example below:
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"adminUsername": {
"type": "string",
"metadata": {
"description": "User name for the Virtual Machine."
}
},
"adminPassword": {
"type": "securestring",
"metadata": {
"description": "Password for the Virtual Machine."
}
},
"dnsLabelPrefix": {
"type": "string",
"metadata": {
"description": "Unique DNS Name for the Public IP used to access the Virtual Machine."
}
},
"ubuntuOSVersion": {
"type": "string",
"defaultValue": "16.04.0-LTS",
"allowedValues": [
"12.04.5-LTS",
"14.04.5-LTS",
"15.10",
"16.04.0-LTS"
],
"metadata": {
"description": "The Ubuntu version for the VM. This will pick a fully patched image of this given Ubuntu version."
}
},
"location": {
"type": "string",
"defaultValue": "[resourceGroup().location]",
"metadata": {
"description": "Location for all resources."
}
}
},
"variables": {
"storageAccountName": "[concat(uniquestring(resourceGroup().id), 'salinuxvm')]",
"imagePublisher": "Canonical",
"imageOffer": "UbuntuServer",
"nicName": "myVMNic",
"addressPrefix": "10.0.0.0/16",
"subnetName": "Subnet",
"subnetPrefix": "10.0.0.0/24",
"storageAccountType": "Standard_LRS",
"publicIPAddressName": "myPublicIP",
"publicIPAddressType": "Dynamic",
"vmName": "MyUbuntuVM",
"vmSize": "Standard_A1",
"virtualNetworkName": "MyVNET",
"subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]"
},
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"name": "[variables('storageAccountName')]",
"apiVersion": "2017-06-01",
"location": "[parameters('location')]",
"sku": {
"name": "[variables('storageAccountType')]"
},
"kind": "Storage",
"properties": {}
},
{
"apiVersion": "2017-04-01",
"type": "Microsoft.Network/publicIPAddresses",
"name": "[variables('publicIPAddressName')]",
"location": "[parameters('location')]",
"properties": {
"publicIPAllocationMethod": "[variables('publicIPAddressType')]",
"dnsSettings": {
"domainNameLabel": "[parameters('dnsLabelPrefix')]"
}
}
},
{
"apiVersion": "2017-04-01",
"type": "Microsoft.Network/virtualNetworks",
"name": "[variables('virtualNetworkName')]",
"location": "[parameters('location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"[variables('addressPrefix')]"
]
},
"subnets": [
{
"name": "[variables('subnetName')]",
"properties": {
"addressPrefix": "[variables('subnetPrefix')]"
}
}
]
}
},
{
"apiVersion": "2017-04-01",
"type": "Microsoft.Network/networkInterfaces",
"name": "[variables('nicName')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]",
"[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]"
],
"properties": {
"ipConfigurations": [
{
"name": "ipconfig1",
"properties": {
"privateIPAllocationMethod": "Dynamic",
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName'))]"
},
"subnet": {
"id": "[variables('subnetRef')]"
}
}
}
]
}
},
{
"apiVersion": "2017-03-30",
"type": "Microsoft.Compute/virtualMachines",
"name": "[variables('vmName')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]",
"[resourceId('Microsoft.Network/networkInterfaces/', variables('nicName'))]"
],
"properties": {
"hardwareProfile": {
"vmSize": "[variables('vmSize')]"
},
"osProfile": {
"computerName": "[variables('vmName')]",
"adminUsername": "[parameters('adminUsername')]",
"adminPassword": "[parameters('adminPassword')]"
},
"storageProfile": {
"imageReference": {
"publisher": "[variables('imagePublisher')]",
"offer": "[variables('imageOffer')]",
"sku": "[parameters('ubuntuOSVersion')]",
"version": "latest"
},
"osDisk": {
"createOption": "FromImage"
},
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId('Microsoft.Network/networkInterfaces',variables('nicName'))]"
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": true,
"storageUri": "[concat(reference(concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName')), '2016-01-01').primaryEndpoints.blob)]"
}
}
}
}
],
"outputs": {
"hostname": {
"type": "string",
"value": "[reference(variables('publicIPAddressName')).dnsSettings.fqdn]"
},
"sshCommand": {
"type": "string",
"value": "[concat('ssh ', parameters('adminUsername'), '#', reference(variables('publicIPAddressName')).dnsSettings.fqdn)]"
}
}
}
Also, the NSG rules will be check if it allows the traffic. Hope this will help you.
Update
When you create the VM with a password, the configuration of the password in the template after creating the VM will like below and you cannot see the password because of the security:
If you create the VM with the public ssh key, it will like this:
You set both authentication ways in the template you posted that you use to create VM. Please select one to set. If you choose the password please follow the template I have posted above.