# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

# E2E Test: Guest Configuration/LinuxSshServerSecurityBaseline_DINE
# Real Azure Policy: "[Preview]: Configure SSH Posture Control on Linux machines"
# Source: regolator/policyDefinitions/Guest Configuration/LinuxSshServerSecurityBaseline_DINE.json
#
# Features exercised:
#   - 4th largest policy by line count (910 lines)
#   - 19 SSH configuration parameters
#   - base64(concat(...)) in existenceCondition for parameterHash
#   - Tag-based AKS exclusion (tags['aks-managed-...'])
#   - Multiple target types: VM, VMSS, HybridCompute, ConnectedVMwarevSphere
#   - IncludeArcMachines as string parameter "true"/"false"
#   - Conditional deployment for 3 different machine types
#   - Guest configuration assignment with configurationParameters

aliases: test_aliases.json

policy_definition: |
  {
    "properties": {
      "displayName": "[Preview]: Configure SSH Posture Control on Linux machines",
      "policyType": "BuiltIn",
      "mode": "Indexed",
      "description": "This policy creates a Guest Configuration assignment to set SSH Posture Control on Linux machines.",
      "version": "1.0.0-preview",
      "parameters": {
        "IncludeArcMachines": {
          "type": "string",
          "metadata": {
            "displayName": "Include Arc connected servers",
            "description": "By selecting this option, you agree to be charged monthly per Arc connected machine.",
            "portalReview": "true"
          },
          "allowedValues": [
            "true",
            "false"
          ],
          "defaultValue": "false"
        },
        "effect": {
          "type": "string",
          "metadata": {
            "displayName": "Effect",
            "description": "Enable or disable the execution of this policy"
          },
          "allowedValues": [
            "DeployIfNotExists",
            "Disabled"
          ],
          "defaultValue": "DeployIfNotExists"
        },
        "accessPermissionsForSshdConfig": {
          "type": "string",
          "metadata": {
            "displayName": "Access permissions for sshd_config",
            "description": "File access permissions for /etc/ssh/sshd_config. Default is '600'"
          },
          "defaultValue": "600"
        },
        "ignoreHosts": {
          "type": "string",
          "metadata": {
            "displayName": "Ignore rhosts and shosts",
            "description": "Whether to ignore per-user .rhosts and .shosts files during HostbasedAuthentication. Default is 'yes'"
          },
          "defaultValue": "yes"
        },
        "logLevel": {
          "type": "string",
          "metadata": {
            "displayName": "Log verbosity level",
            "description": "The verbosity level for the sshd logging. Default is 'INFO'"
          },
          "defaultValue": "INFO"
        },
        "maxAuthTries": {
          "type": "string",
          "metadata": {
            "displayName": "Maximum number of authentication attempts",
            "description": "The maximum number of authentication attempts permitted per connection. Default is '6'"
          },
          "defaultValue": "6"
        },
        "allowUsers": {
          "type": "string",
          "metadata": {
            "displayName": "Allowed users for SSH",
            "description": "List of users to be allowed to connect with SSH. Default is all authenticated users ('*@*')"
          },
          "defaultValue": "*@*"
        },
        "denyUsers": {
          "type": "string",
          "metadata": {
            "displayName": "Denied users for SSH",
            "description": "List of users to be denied to connect with SSH. Default is 'root'"
          },
          "defaultValue": "root"
        },
        "allowGroups": {
          "type": "string",
          "metadata": {
            "displayName": "Allowed groups for SSH",
            "description": "List of user groups to be allowed to connect with SSH. Default is all groups ('*')"
          },
          "defaultValue": "*"
        },
        "denyGroups": {
          "type": "string",
          "metadata": {
            "displayName": "Denied groups for SSH",
            "description": "List of user groups to be denied to connect with SSH. Default is 'root'"
          },
          "defaultValue": "root"
        },
        "hostBasedAuthentication": {
          "type": "string",
          "metadata": {
            "displayName": "Host-based authentication",
            "description": "Host-based authentication. Default is 'no'"
          },
          "defaultValue": "no"
        },
        "permitRootLogin": {
          "type": "string",
          "metadata": {
            "displayName": "Whether root can log in using ssh",
            "description": "Whether root can log in using ssh. Default is 'no'"
          },
          "defaultValue": "no"
        },
        "permitEmptyPasswords": {
          "type": "string",
          "metadata": {
            "displayName": "Whether the server allows login to accounts with empty password strings",
            "description": "Whether the server allows login to accounts with empty password strings. Default is 'no'"
          },
          "defaultValue": "no"
        },
        "clientAliveCountMax": {
          "type": "string",
          "metadata": {
            "displayName": "The number of client alive messages which may be sent without sshd receiving any messages back from the client",
            "description": "The number of client alive messages which may be sent without sshd receiving any messages back from the client. Default is '0'"
          },
          "defaultValue": "0"
        },
        "clientAliveInterval": {
          "type": "string",
          "metadata": {
            "displayName": "Timeout interval in seconds after which if no data has been received from the client, sshd will send a message to request a response",
            "description": "Timeout interval in seconds after which if no data has been received from the client, sshd will send a message to request a response. Default is  1 hour ('3600')"
          },
          "defaultValue": "3600"
        },
        "loginGraceTime": {
          "type": "string",
          "metadata": {
            "displayName": "The time in seconds after which the server disconnects if the user has not successfully logged in",
            "description": "The time in seconds after which the server disconnects if the user has not successfully logged in. Default is 1 minute ('60')"
          },
          "defaultValue": "60"
        },
        "messageAuthenticationCodeAlgorithms": {
          "type": "string",
          "metadata": {
            "displayName": "The list of available message authentication code (MAC) algorithms",
            "description": "The list of available message authentication code (MAC) algorithms. Default is 'hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com'"
          },
          "defaultValue": "hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com"
        },
        "banner": {
          "type": "string",
          "metadata": {
            "displayName": "The contents of the banner file that is sent to the remote user before authentication is allowed",
            "description": "The contents of the banner file that is sent to the remote user before authentication is allowed. Default is '#######################################################################\n\nAuthorized access only!\n\nIf you are not authorized to access or use this system, disconnect now!\n\n#######################################################################\n'"
          },
          "defaultValue": "#######################################################################\n\nAuthorized access only!\n\nIf you are not authorized to access or use this system, disconnect now!\n\n#######################################################################\n"
        },
        "permitUserEnvironment": {
          "type": "string",
          "metadata": {
            "displayName": "Whether ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd",
            "description": "Whether ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. Default is 'no'"
          },
          "defaultValue": "no"
        },
        "ciphers": {
          "type": "string",
          "metadata": {
            "displayName": "The list of allowed ciphers",
            "description": "The list of allowed ciphers. Default is 'aes128-ctr,aes192-ctr,aes256-ctr'"
          },
          "defaultValue": "aes128-ctr,aes192-ctr,aes256-ctr"
        },
        "port": {
          "type": "string",
          "metadata": {
            "displayName": "The SSH port",
            "description": "The SSH port. Default is '22'"
          },
          "defaultValue": "22"
        }
      },
      "policyRule": {
        "if": {
          "anyOf": [
            {
              "allOf": [
                {
                  "anyOf": [
                    {
                      "field": "type",
                      "equals": "Microsoft.Compute/virtualMachines"
                    },
                    {
                      "field": "type",
                      "equals": "Microsoft.Compute/virtualMachineScaleSets"
                    }
                  ]
                },
                {
                  "field": "tags['aks-managed-orchestrator']",
                  "exists": false
                },
                {
                  "field": "tags['aks-managed-poolName']",
                  "exists": false
                },
                {
                  "anyOf": [
                    {
                      "field": "Microsoft.Compute/imagePublisher",
                      "in": [
                        "microsoft-aks",
                        "qubole-inc",
                        "datastax",
                        "couchbase",
                        "scalegrid",
                        "checkpoint",
                        "paloaltonetworks",
                        "debian",
                        "credativ"
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Compute/imagePublisher",
                          "equals": "OpenLogic"
                        },
                        {
                          "field": "Microsoft.Compute/imageSKU",
                          "notLike": "6*"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Compute/imagePublisher",
                          "equals": "Oracle"
                        },
                        {
                          "field": "Microsoft.Compute/imageSKU",
                          "notLike": "6*"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Compute/imagePublisher",
                          "equals": "RedHat"
                        },
                        {
                          "field": "Microsoft.Compute/imageSKU",
                          "notLike": "6*"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Compute/imagePublisher",
                          "equals": "center-for-internet-security-inc"
                        },
                        {
                          "field": "Microsoft.Compute/imageOffer",
                          "notLike": "cis-win*"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Compute/imagePublisher",
                          "equals": "Suse"
                        },
                        {
                          "field": "Microsoft.Compute/imageSKU",
                          "notLike": "11*"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Compute/imagePublisher",
                          "equals": "Canonical"
                        },
                        {
                          "field": "Microsoft.Compute/imageSKU",
                          "notLike": "12*"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Compute/imagePublisher",
                          "equals": "microsoft-dsvm"
                        },
                        {
                          "field": "Microsoft.Compute/imageOffer",
                          "notLike": "dsvm-win*"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Compute/imagePublisher",
                          "equals": "cloudera"
                        },
                        {
                          "field": "Microsoft.Compute/imageSKU",
                          "notLike": "6*"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "Microsoft.Compute/imagePublisher",
                          "equals": "microsoft-ads"
                        },
                        {
                          "field": "Microsoft.Compute/imageOffer",
                          "like": "linux*"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "anyOf": [
                            {
                              "field": "Microsoft.Compute/virtualMachines/osProfile.linuxConfiguration",
                              "exists": true
                            },
                            {
                              "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
                              "like": "Linux*"
                            }
                          ]
                        },
                        {
                          "anyOf": [
                            {
                              "field": "Microsoft.Compute/imagePublisher",
                              "exists": false
                            },
                            {
                              "field": "Microsoft.Compute/imagePublisher",
                              "notIn": [
                                "OpenLogic",
                                "RedHat",
                                "credativ",
                                "Suse",
                                "Canonical",
                                "microsoft-dsvm",
                                "cloudera",
                                "microsoft-ads",
                                "center-for-internet-security-inc",
                                "Oracle",
                                "AzureDatabricks",
                                "azureopenshift"
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            },
            {
              "allOf": [
                {
                  "value": "[parameters('IncludeArcMachines')]",
                  "equals": true
                },
                {
                  "anyOf": [
                    {
                      "allOf": [
                        {
                          "field": "type",
                          "equals": "Microsoft.HybridCompute/machines"
                        },
                        {
                          "field": "Microsoft.HybridCompute/imageOffer",
                          "like": "linux*"
                        }
                      ]
                    },
                    {
                      "allOf": [
                        {
                          "field": "type",
                          "equals": "Microsoft.ConnectedVMwarevSphere/virtualMachines"
                        },
                        {
                          "field": "Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType",
                          "like": "linux*"
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        },
        "then": {
          "effect": "[parameters('effect')]",
          "details": {
            "roleDefinitionIds": [
              "/providers/microsoft.authorization/roleDefinitions/088ab73d-1256-47ae-bea9-9de8e7131f31"
            ],
            "name": "SetLinuxSshServerSecurityBaseline",
            "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
            "existenceCondition": {
              "allOf": [
                {
                  "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash",
                  "equals": "[base64(concat('Ensure that permissions on /etc/ssh/sshd_config are configured;DesiredObjectValue', '=', parameters('accessPermissionsForSshdConfig'), ',', 'Ensure that the SSH IgnoreRhosts is configured;DesiredObjectValue', '=', parameters('ignoreHosts'), ',', 'Ensure that the SSH LogLevel is configured;DesiredObjectValue', '=', parameters('logLevel'), ',', 'Ensure that the SSH MaxAuthTries is configured;DesiredObjectValue', '=', parameters('maxAuthTries'), ',', 'Ensure that the allowed users for SSH access are configured;DesiredObjectValue', '=', parameters('allowUsers'), ',', 'Ensure that the denied users for SSH are configured;DesiredObjectValue', '=', parameters('denyUsers'), ',', 'Ensure that the allowed groups for SSH are configured;DesiredObjectValue', '=', parameters('allowGroups'), ',', 'Ensure that the denied groups for SSH are configured;DesiredObjectValue', '=', parameters('denyGroups'), ',', 'Ensure that the SSH HostBasedAuthentication is configured;DesiredObjectValue', '=', parameters('hostBasedAuthentication'), ',', 'Ensure that the SSH PermitRootLogin is configured;DesiredObjectValue', '=', parameters('permitRootLogin'), ',', 'Ensure that the SSH PermitEmptyPasswords is configured;DesiredObjectValue', '=', parameters('permitEmptyPasswords'), ',', 'Ensure that the SSH ClientAliveCountMax is configured;DesiredObjectValue', '=', parameters('clientAliveCountMax'), ',', 'Ensure that the SSH ClientAliveInterval is configured;DesiredObjectValue', '=', parameters('clientAliveInterval'), ',', 'Ensure that the SSH LoginGraceTime is configured;DesiredObjectValue', '=', parameters('loginGraceTime'), ',', 'Ensure that only approved MAC algorithms are used;DesiredObjectValue', '=', parameters('messageAuthenticationCodeAlgorithms'), ',', 'Ensure that the SSH warning banner is configured;DesiredObjectValue', '=', parameters('banner'), ',', 'Ensure that the SSH PermitUserEnvironment is configured;DesiredObjectValue', '=', parameters('permitUserEnvironment'), ',', 'Ensure that appropriate ciphers are used for SSH;DesiredObjectValue', '=', parameters('ciphers'), ',', 'Ensure that the SSH port is configured;DesiredObjectValue', '=', parameters('port')))]"
                },
                {
                  "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus",
                  "equals": "Compliant"
                }
              ]
            },
            "deployment": {
              "properties": {
                "mode": "incremental",
                "parameters": {
                  "vmName": {
                    "value": "[field('name')]"
                  },
                  "location": {
                    "value": "[field('location')]"
                  },
                  "type": {
                    "value": "[field('type')]"
                  },
                  "configurationName": {
                    "value": "SetLinuxSshServerSecurityBaseline"
                  },
                  "accessPermissionsForSshdConfig": {
                    "value": "[parameters('accessPermissionsForSshdConfig')]"
                  },
                  "ignoreHosts": {
                    "value": "[parameters('ignoreHosts')]"
                  },
                  "logLevel": {
                    "value": "[parameters('logLevel')]"
                  },
                  "maxAuthTries": {
                    "value": "[parameters('maxAuthTries')]"
                  },
                  "allowUsers": {
                    "value": "[parameters('allowUsers')]"
                  },
                  "denyUsers": {
                    "value": "[parameters('denyUsers')]"
                  },
                  "allowGroups": {
                    "value": "[parameters('allowGroups')]"
                  },
                  "denyGroups": {
                    "value": "[parameters('denyGroups')]"
                  },
                  "hostBasedAuthentication": {
                    "value": "[parameters('hostBasedAuthentication')]"
                  },
                  "permitRootLogin": {
                    "value": "[parameters('permitRootLogin')]"
                  },
                  "permitEmptyPasswords": {
                    "value": "[parameters('permitEmptyPasswords')]"
                  },
                  "clientAliveCountMax": {
                    "value": "[parameters('clientAliveCountMax')]"
                  },
                  "clientAliveInterval": {
                    "value": "[parameters('clientAliveInterval')]"
                  },
                  "loginGraceTime": {
                    "value": "[parameters('loginGraceTime')]"
                  },
                  "messageAuthenticationCodeAlgorithms": {
                    "value": "[parameters('messageAuthenticationCodeAlgorithms')]"
                  },
                  "banner": {
                    "value": "[parameters('banner')]"
                  },
                  "permitUserEnvironment": {
                    "value": "[parameters('permitUserEnvironment')]"
                  },
                  "ciphers": {
                    "value": "[parameters('ciphers')]"
                  },
                  "port": {
                    "value": "[parameters('port')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "parameters": {
                    "vmName": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string"
                    },
                    "type": {
                      "type": "string"
                    },
                    "configurationName": {
                      "type": "string"
                    },
                    "accessPermissionsForSshdConfig": {
                      "type": "string"
                    },
                    "ignoreHosts": {
                      "type": "string"
                    },
                    "logLevel": {
                      "type": "string"
                    },
                    "maxAuthTries": {
                      "type": "string"
                    },
                    "allowUsers": {
                      "type": "string"
                    },
                    "denyUsers": {
                      "type": "string"
                    },
                    "allowGroups": {
                      "type": "string"
                    },
                    "denyGroups": {
                      "type": "string"
                    },
                    "hostBasedAuthentication": {
                      "type": "string"
                    },
                    "permitRootLogin": {
                      "type": "string"
                    },
                    "permitEmptyPasswords": {
                      "type": "string"
                    },
                    "clientAliveCountMax": {
                      "type": "string"
                    },
                    "clientAliveInterval": {
                      "type": "string"
                    },
                    "loginGraceTime": {
                      "type": "string"
                    },
                    "messageAuthenticationCodeAlgorithms": {
                      "type": "string"
                    },
                    "banner": {
                      "type": "string"
                    },
                    "permitUserEnvironment": {
                      "type": "string"
                    },
                    "ciphers": {
                      "type": "string"
                    },
                    "port": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "condition": "[equals(toLower(parameters('type')), toLower('microsoft.hybridcompute/machines'))]",
                      "apiVersion": "2018-11-20",
                      "type": "Microsoft.HybridCompute/machines/providers/guestConfigurationAssignments",
                      "name": "[concat(parameters('vmName'), '/Microsoft.GuestConfiguration/', parameters('configurationName'))]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "guestConfiguration": {
                          "name": "[parameters('configurationName')]",
                          "version": "1.*",
                          "assignmentType": "ApplyAndAutoCorrect",
                          "configurationParameter": [
                            {
                              "name": "Ensure that permissions on /etc/ssh/sshd_config are configured;DesiredObjectValue",
                              "value": "[parameters('accessPermissionsForSshdConfig')]"
                            },
                            {
                              "name": "Ensure that the SSH IgnoreRhosts is configured;DesiredObjectValue",
                              "value": "[parameters('ignoreHosts')]"
                            },
                            {
                              "name": "Ensure that the SSH LogLevel is configured;DesiredObjectValue",
                              "value": "[parameters('logLevel')]"
                            },
                            {
                              "name": "Ensure that the SSH MaxAuthTries is configured;DesiredObjectValue",
                              "value": "[parameters('maxAuthTries')]"
                            },
                            {
                              "name": "Ensure that the allowed users for SSH access are configured;DesiredObjectValue",
                              "value": "[parameters('allowUsers')]"
                            },
                            {
                              "name": "Ensure that the denied users for SSH are configured;DesiredObjectValue",
                              "value": "[parameters('denyUsers')]"
                            },
                            {
                              "name": "Ensure that the allowed groups for SSH are configured;DesiredObjectValue",
                              "value": "[parameters('allowGroups')]"
                            },
                            {
                              "name": "Ensure that the denied groups for SSH are configured;DesiredObjectValue",
                              "value": "[parameters('denyGroups')]"
                            },
                            {
                              "name": "Ensure that the SSH HostBasedAuthentication is configured;DesiredObjectValue",
                              "value": "[parameters('hostBasedAuthentication')]"
                            },
                            {
                              "name": "Ensure that the SSH PermitRootLogin is configured;DesiredObjectValue",
                              "value": "[parameters('permitRootLogin')]"
                            },
                            {
                              "name": "Ensure that the SSH PermitEmptyPasswords is configured;DesiredObjectValue",
                              "value": "[parameters('permitEmptyPasswords')]"
                            },
                            {
                              "name": "Ensure that the SSH ClientAliveCountMax is configured;DesiredObjectValue",
                              "value": "[parameters('clientAliveCountMax')]"
                            },
                            {
                              "name": "Ensure that the SSH ClientAliveInterval is configured;DesiredObjectValue",
                              "value": "[parameters('clientAliveInterval')]"
                            },
                            {
                              "name": "Ensure that the SSH LoginGraceTime is configured;DesiredObjectValue",
                              "value": "[parameters('loginGraceTime')]"
                            },
                            {
                              "name": "Ensure that only approved MAC algorithms are used;DesiredObjectValue",
                              "value": "[parameters('messageAuthenticationCodeAlgorithms')]"
                            },
                            {
                              "name": "Ensure that the SSH warning banner is configured;DesiredObjectValue",
                              "value": "[parameters('banner')]"
                            },
                            {
                              "name": "Ensure that the SSH PermitUserEnvironment is configured;DesiredObjectValue",
                              "value": "[parameters('permitUserEnvironment')]"
                            },
                            {
                              "name": "Ensure that appropriate ciphers are used for SSH;DesiredObjectValue",
                              "value": "[parameters('ciphers')]"
                            },
                            {
                              "name": "Ensure that the SSH port is configured;DesiredObjectValue",
                              "value": "[parameters('port')]"
                            }
                          ]
                        }
                      }
                    },
                    {
                      "condition": "[equals(toLower(parameters('type')), toLower('Microsoft.Compute/virtualMachines'))]",
                      "apiVersion": "2018-11-20",
                      "type": "Microsoft.Compute/virtualMachines/providers/guestConfigurationAssignments",
                      "name": "[concat(parameters('vmName'), '/Microsoft.GuestConfiguration/', parameters('configurationName'))]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "guestConfiguration": {
                          "name": "[parameters('configurationName')]",
                          "version": "1.*",
                          "assignmentType": "ApplyAndAutoCorrect",
                          "configurationParameter": [
                            {
                              "name": "Ensure that permissions on /etc/ssh/sshd_config are configured;DesiredObjectValue",
                              "value": "[parameters('accessPermissionsForSshdConfig')]"
                            },
                            {
                              "name": "Ensure that the SSH IgnoreRhosts is configured;DesiredObjectValue",
                              "value": "[parameters('ignoreHosts')]"
                            },
                            {
                              "name": "Ensure that the SSH LogLevel is configured;DesiredObjectValue",
                              "value": "[parameters('logLevel')]"
                            },
                            {
                              "name": "Ensure that the SSH MaxAuthTries is configured;DesiredObjectValue",
                              "value": "[parameters('maxAuthTries')]"
                            },
                            {
                              "name": "Ensure that the allowed users for SSH access are configured;DesiredObjectValue",
                              "value": "[parameters('allowUsers')]"
                            },
                            {
                              "name": "Ensure that the denied users for SSH are configured;DesiredObjectValue",
                              "value": "[parameters('denyUsers')]"
                            },
                            {
                              "name": "Ensure that the allowed groups for SSH are configured;DesiredObjectValue",
                              "value": "[parameters('allowGroups')]"
                            },
                            {
                              "name": "Ensure that the denied groups for SSH are configured;DesiredObjectValue",
                              "value": "[parameters('denyGroups')]"
                            },
                            {
                              "name": "Ensure that the SSH HostBasedAuthentication is configured;DesiredObjectValue",
                              "value": "[parameters('hostBasedAuthentication')]"
                            },
                            {
                              "name": "Ensure that the SSH PermitRootLogin is configured;DesiredObjectValue",
                              "value": "[parameters('permitRootLogin')]"
                            },
                            {
                              "name": "Ensure that the SSH PermitEmptyPasswords is configured;DesiredObjectValue",
                              "value": "[parameters('permitEmptyPasswords')]"
                            },
                            {
                              "name": "Ensure that the SSH ClientAliveCountMax is configured;DesiredObjectValue",
                              "value": "[parameters('clientAliveCountMax')]"
                            },
                            {
                              "name": "Ensure that the SSH ClientAliveInterval is configured;DesiredObjectValue",
                              "value": "[parameters('clientAliveInterval')]"
                            },
                            {
                              "name": "Ensure that the SSH LoginGraceTime is configured;DesiredObjectValue",
                              "value": "[parameters('loginGraceTime')]"
                            },
                            {
                              "name": "Ensure that only approved MAC algorithms are used;DesiredObjectValue",
                              "value": "[parameters('messageAuthenticationCodeAlgorithms')]"
                            },
                            {
                              "name": "Ensure that the SSH warning banner is configured;DesiredObjectValue",
                              "value": "[parameters('banner')]"
                            },
                            {
                              "name": "Ensure that the SSH PermitUserEnvironment is configured;DesiredObjectValue",
                              "value": "[parameters('permitUserEnvironment')]"
                            },
                            {
                              "name": "Ensure that appropriate ciphers are used for SSH;DesiredObjectValue",
                              "value": "[parameters('ciphers')]"
                            },
                            {
                              "name": "Ensure that the SSH port is configured;DesiredObjectValue",
                              "value": "[parameters('port')]"
                            }
                          ]
                        }
                      }
                    },
                    {
                      "condition": "[equals(toLower(parameters('type')), toLower('Microsoft.ConnectedVMwarevSphere/virtualMachines'))]",
                      "apiVersion": "2018-11-20",
                      "type": "Microsoft.ConnectedVMwarevSphere/virtualMachines/providers/guestConfigurationAssignments",
                      "name": "[concat(parameters('vmName'), '/Microsoft.GuestConfiguration/', parameters('configurationName'))]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "guestConfiguration": {
                          "name": "[parameters('configurationName')]",
                          "version": "1.*",
                          "assignmentType": "ApplyAndAutoCorrect",
                          "configurationParameter": [
                            {
                              "name": "Ensure that permissions on /etc/ssh/sshd_config are configured;DesiredObjectValue",
                              "value": "[parameters('accessPermissionsForSshdConfig')]"
                            },
                            {
                              "name": "Ensure that the SSH IgnoreRhosts is configured;DesiredObjectValue",
                              "value": "[parameters('ignoreHosts')]"
                            },
                            {
                              "name": "Ensure that the SSH LogLevel is configured;DesiredObjectValue",
                              "value": "[parameters('logLevel')]"
                            },
                            {
                              "name": "Ensure that the SSH MaxAuthTries is configured;DesiredObjectValue",
                              "value": "[parameters('maxAuthTries')]"
                            },
                            {
                              "name": "Ensure that the allowed users for SSH access are configured;DesiredObjectValue",
                              "value": "[parameters('allowUsers')]"
                            },
                            {
                              "name": "Ensure that the denied users for SSH are configured;DesiredObjectValue",
                              "value": "[parameters('denyUsers')]"
                            },
                            {
                              "name": "Ensure that the allowed groups for SSH are configured;DesiredObjectValue",
                              "value": "[parameters('allowGroups')]"
                            },
                            {
                              "name": "Ensure that the denied groups for SSH are configured;DesiredObjectValue",
                              "value": "[parameters('denyGroups')]"
                            },
                            {
                              "name": "Ensure that the SSH HostBasedAuthentication is configured;DesiredObjectValue",
                              "value": "[parameters('hostBasedAuthentication')]"
                            },
                            {
                              "name": "Ensure that the SSH PermitRootLogin is configured;DesiredObjectValue",
                              "value": "[parameters('permitRootLogin')]"
                            },
                            {
                              "name": "Ensure that the SSH PermitEmptyPasswords is configured;DesiredObjectValue",
                              "value": "[parameters('permitEmptyPasswords')]"
                            },
                            {
                              "name": "Ensure that the SSH ClientAliveCountMax is configured;DesiredObjectValue",
                              "value": "[parameters('clientAliveCountMax')]"
                            },
                            {
                              "name": "Ensure that the SSH ClientAliveInterval is configured;DesiredObjectValue",
                              "value": "[parameters('clientAliveInterval')]"
                            },
                            {
                              "name": "Ensure that the SSH LoginGraceTime is configured;DesiredObjectValue",
                              "value": "[parameters('loginGraceTime')]"
                            },
                            {
                              "name": "Ensure that only approved MAC algorithms are used;DesiredObjectValue",
                              "value": "[parameters('messageAuthenticationCodeAlgorithms')]"
                            },
                            {
                              "name": "Ensure that the SSH warning banner is configured;DesiredObjectValue",
                              "value": "[parameters('banner')]"
                            },
                            {
                              "name": "Ensure that the SSH PermitUserEnvironment is configured;DesiredObjectValue",
                              "value": "[parameters('permitUserEnvironment')]"
                            },
                            {
                              "name": "Ensure that appropriate ciphers are used for SSH;DesiredObjectValue",
                              "value": "[parameters('ciphers')]"
                            },
                            {
                              "name": "Ensure that the SSH port is configured;DesiredObjectValue",
                              "value": "[parameters('port')]"
                            }
                          ]
                        }
                      }
                    }
                  ]
                }
              }
            }
          }
        }
      }
    }
  }

cases:
  # =========================================================================
  # DINE — Linux VM with Canonical publisher, no guest config assignment
  # =========================================================================

  - note: dine_linux_vm_canonical
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "vm-ubuntu-ssh"
      location: "eastus"
      tags: {}
      properties:
        osProfile:
          linuxConfiguration: {}
        storageProfile:
          osDisk:
            osType: "Linux"
          imageReference:
            publisher: "Canonical"
            offer: "UbuntuServer"
            sku: "18.04-LTS"
    parameters:
      effect: "DeployIfNotExists"
      IncludeArcMachines: "false"
    host_await:
      - key:
          operation: "lookup_related_resources"
          type: "Microsoft.GuestConfiguration/guestConfigurationAssignments"
          name: "SetLinuxSshServerSecurityBaseline"
        response: null
    want_effect: "DeployIfNotExists"

  # =========================================================================
  # Pass — VM with AKS-managed tags → excluded by tag filter
  # =========================================================================

  - note: pass_aks_managed_vm
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "aks-node-vm"
      location: "eastus"
      tags:
        aks-managed-orchestrator: "1.27"
        aks-managed-poolName: "default"
      properties:
        osProfile:
          linuxConfiguration: {}
        storageProfile:
          osDisk:
            osType: "Linux"
          imageReference:
            publisher: "Canonical"
            offer: "UbuntuServer"
            sku: "18.04-LTS"
    parameters:
      effect: "DeployIfNotExists"
      IncludeArcMachines: "false"
    want_undefined: true

  # =========================================================================
  # Pass — Windows VM (no linuxConfiguration)
  # =========================================================================

  - note: pass_windows_vm
    resource:
      type: "Microsoft.Compute/virtualMachines"
      name: "vm-windows"
      location: "eastus"
      tags: {}
      properties:
        osProfile:
          windowsConfiguration: {}
        storageProfile:
          osDisk:
            osType: "Windows"
          imageReference:
            publisher: "MicrosoftWindowsServer"
            offer: "WindowsServer"
            sku: "2019-Datacenter"
    parameters:
      effect: "DeployIfNotExists"
      IncludeArcMachines: "false"
    want_undefined: true

  # =========================================================================
  # DINE — Arc machine (HybridCompute) when IncludeArcMachines=true
  # =========================================================================

  - note: dine_arc_machine_when_included
    resource:
      type: "Microsoft.HybridCompute/machines"
      name: "arc-linux-ssh"
      location: "eastus"
      properties:
        imageOffer: "linux"
    parameters:
      effect: "DeployIfNotExists"
      IncludeArcMachines: "true"
    host_await:
      - key:
          operation: "lookup_related_resources"
          type: "Microsoft.GuestConfiguration/guestConfigurationAssignments"
          name: "SetLinuxSshServerSecurityBaseline"
        response: null
    want_effect: "DeployIfNotExists"

  # =========================================================================
  # Pass — Arc machine when IncludeArcMachines=false
  # =========================================================================

  - note: pass_arc_machine_when_excluded
    resource:
      type: "Microsoft.HybridCompute/machines"
      name: "arc-linux-excluded"
      location: "eastus"
      properties:
        imageOffer: "linux"
    parameters:
      effect: "DeployIfNotExists"
      IncludeArcMachines: "false"
    want_undefined: true

  # =========================================================================
  # Skip — wrong resource type
  # =========================================================================

  - note: skip_wrong_type
    resource:
      type: "Microsoft.Storage/storageAccounts"
      name: "staccount1"
      location: "eastus"
      properties: {}
    parameters:
      effect: "DeployIfNotExists"
      IncludeArcMachines: "false"
    want_undefined: true
