Connecting to a virtual machine via OS Login
OS Login is used to provide users with SSH access to VMs through IAM. To grant access to a VM that supports OS Login at the OS level, assign a user the compute.osLogin
or compute.osAdminLogin
role.
Getting started
If you do not have the Yandex Cloud command line interface yet, install and initialize it.
The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name
or --folder-id
parameter.
Create a new virtual machine with OS Login support or set up access via OS Login for an existing VM as needed.
Connecting to a VM via OS Login using an SSH certificate over the YC CLI
-
Enable access via OS Login at the organization level.
To connect to a VM via OS Login using an SSH certificate over the YC CLI, enable Access via OS Login using SSH certificates (recommended).
-
View the description of the CLI command to connect to a VM:
yc compute ssh --help
-
Get a list of all VMs in the default folder:
yc compute instance list
Result:
+----------------------+-----------------+---------------+---------+----------------------+ | ID | NAME | ZONE ID | STATUS | DESCRIPTION | +----------------------+-----------------+---------------+---------+----------------------+ | fhm0b28lgf********** | first-instance | ru-central1-a | RUNNING | my first vm via CLI | | fhm9gk85nj********** | second-instance | ru-central1-a | RUNNING | my second vm via CLI | +----------------------+-----------------+---------------+---------+----------------------+
-
Connect to the VM:
To connect via OS login, use the VM name:
yc compute ssh \ --name <VM_name>
When connecting via OS Login, you can specify the VM ID instead of its name:
yc compute ssh \ --id <VM_ID>
To connect via OS login by internal IP address, use the
--internal-address
parameter:yc compute ssh \ --name <VM_name> \ --internal-address
Connecting to a VM via OS Login using an SSH certificate over a standard SSH client
You can use a standard SSH client to connect to VMs with OS Login access enabled. To do this, export an OS Login certificate to your local computer and specify this certificate when connecting to a VM:
-
Enable access via OS Login at the organization level.
To connect to a VM via OS Login using an SSH certificate over a standard SSH client, enable Access via OS Login using SSH certificates (recommended).
-
Get a list of all VMs in the default folder:
yc compute instance list
Result:
+----------------------+-----------------+---------------+---------+---------------+--------------+ | ID | NAME | ZONE ID | STATUS | EXTERNAL IP | INTERNAL IP | +----------------------+-----------------+---------------+---------+---------------+--------------+ | fhm0b28lgf********** | first-instance | ru-central1-a | RUNNING | 158.160.**.** | 192.168.0.8 | | fhm9gk85nj********** | second-instance | ru-central1-a | RUNNING | 51.250.**.*** | 192.168.0.12 | +----------------------+-----------------+---------------+---------+---------------+--------------+
-
Get a public address of the VM by specifying its ID:
yc compute instance get \ --id <VM_ID>
Result:id: fhm0b28lgf********** folder_id: b1gt6g8ht345******** created_at: "2023-12-09T06:23:04Z" name: first-instance zone_id: ru-central1-a platform_id: standard-v3 resources: memory: "2147483648" cores: "2" core_fraction: "100" status: RUNNING metadata_options: gce_http_endpoint: ENABLED aws_v1_http_endpoint: ENABLED gce_http_token: ENABLED aws_v1_http_token: DISABLED boot_disk: mode: READ_WRITE device_name: epd9m2csd95p******** auto_delete: true disk_id: epd9m2csd95p******** network_interfaces: - index: "0" mac_address: d0:0d:87:75:**:** subnet_id: e2li9tcgi7ii******** primary_v4_address: address: 192.168.0.8 one_to_one_nat: address: 158.160.**.** ip_version: IPV4 gpu_settings: {} fqdn: first-instance.ru-central1.internal scheduling_policy: {} network_settings: type: STANDARD placement_policy: {}
The VM's public address is stated in the
network_interfaces.primary_v4_address.one_to_one_nat.address
field.
-
-
Connect to the VM:
ssh -i <certificate_file_path> <username>@<VM_public_IP_address>
Where:
<certificate_file_path>
: Path to the previously savedIdentity
certificate file, e.g.,/home/user1/.ssh/yc-cloud-id-b1gia87mbaom********-orgusername
.<username>
: Organization user name. You can see the username at the end of the exported OS Login certificate. In the example above, it isorgusername
.<VM_public_IP_address>
: VM's public IP address you got earlier.
If this is your first time connecting to the VM, you will see an unknown host warning:
The authenticity of host '158.160.**.** (158.160.**.**)' can't be established. ECDSA key fingerprint is SHA256:PoaSwqxRc8g6iOXtiH7ayGHpSN0MXwUfWHk********. Are you sure you want to continue connecting (yes/no)?
Type
yes
in the terminal and press Enter.
Note
The certificate is valid for one hour. After this time has elapsed, you will need to export a new certificate to connect to the VM.
Connecting to a VM via OS Login using an SSH key over the YC CLI
You can use a custom SSH key to connect to VMs with OS Login access enabled. To do this, create an SSH key, add it to the organization user profile in Yandex Cloud Organization and specify the following when connecting:
-
Enable access via OS Login at the organization level.
To connect to a VM via OS Login using an SSH key over the YC CLI, enable Access via OS Login using SSH keys.
-
Get a list of all VMs in the default folder:
yc compute instance list
Result:
+----------------------+-----------------+---------------+---------+---------------+--------------+ | ID | NAME | ZONE ID | STATUS | EXTERNAL IP | INTERNAL IP | +----------------------+-----------------+---------------+---------+---------------+--------------+ | fhm0b28lgf********** | first-instance | ru-central1-a | RUNNING | 158.160.**.** | 192.168.0.8 | | fhm9gk85nj********** | second-instance | ru-central1-a | RUNNING | 51.250.**.*** | 192.168.0.12 | +----------------------+-----------------+---------------+---------+---------------+--------------+
-
Connect to the VM:
yc compute ssh \ --name <VM_name> \ --identity-file <path_to_private_SSH_key_file> \ --login <username> \ --internal-address
Where:
--name
: Previously obtained VM name. You can specify the VM ID instead of its name by using the--id
parameter.--identity-file
: Path to the previously saved private SSH key file, e.g.,/home/user1/.ssh/id_ed25519
.--login
: OS Login username.- (Optional)
--internal-address
: To connect using an internal IP address.
You will connect to the specified virtual machine using your SSH key. If this is your first time connecting to this VM, a new user profile will be created in the VM's operating system.