Summary

Restrict access to Azure VMs. Resolves DRIVERS-2987.

Tested CSFLE with C driver: https://spruce.mongodb.com/version/66fc4490ce827200070347f9

Tested CSFLE+OIDC with Go driver: https://spruce.mongodb.com/patch/66fc50fb3bc93e0007ef36a2

Background & Motivation

azure vm create documents:

Defaults to open ports for allowing RDP on Windows and allowing SSH on Linux.

Though the private SSH key is expected to be secured, this PR disables the default open port to follow recommendations noted in DRIVERS-2987.

Every script that may ssh to the Azure VM sets the IP of the network security group. I expect the setup script (create-and-setup-vm.sh) may run on a different Evergreen host scripts used to test (run-command.sh) if Evergreen task groups are used.

After setting an IP, the retry-with-backoff.sh script is to wait until ssh succeeds. The default ATTEMPTS was increased to 10 due to an observed failure on retry.

Adding -n to ssh

The -n parameter is added to ssh commands to prevent reading from stdin.

This appears to solve an observed issue testing with the C driver: The shell.exec would abruptly stop after running an Azure KMS script. Example logs indicate:

- command: shell.exec
  params:
    script: |-
      # ... omitted ...
      AZUREKMS_SRC="testazurekms.tgz" \
      AZUREKMS_DST="./" \
          $DRIVERS_TOOLS/.evergreen/csfle/azurekms/copy-file.sh
      # copy-file.sh succeeded, but `shell.exec` stops!
      # ... omitted ...

https://docs.devprod.prod.corp.mongodb.com/evergreen/Project-Configuration/Project-Commands#shellexec notes:

By default, shell.exec runs sh then pipes your script to its stdin. Use this parameter if your script will be doing something that may change stdin, such as sshing