Contact UsGet started
Yandex Compute Cloud

Connecting to a virtual machine via OS Login

Written by
Updated at August 29, 2024

OS Login is used to provide users with SSH access to VMs through IAM. To grant access to a VM that supports OS Login at the OS level, assign a user the compute.osLogin or compute.osAdminLogin role.

Getting started

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

Create a new virtual machine with OS Login support or set up access via OS Login for an existing VM as needed.

Connecting to a VM via OS Login using an SSH certificate over the YC CLI

  1. Enable access via OS Login at the organization level.

    To connect to a VM via OS Login using an SSH certificate over the YC CLI, enable Access via OS Login using SSH certificates (recommended).

  2. View the description of the CLI command to connect to a VM:

    yc compute ssh --help

  3. Get a list of all VMs in the default folder:

    yc compute instance list

    Result:

    +----------------------+-----------------+---------------+---------+----------------------+
|          ID          |       NAME      |    ZONE ID    | STATUS  |     DESCRIPTION      |
+----------------------+-----------------+---------------+---------+----------------------+
| fhm0b28lgf********** | first-instance  | ru-central1-a | RUNNING | my first vm via CLI  |
| fhm9gk85nj********** | second-instance | ru-central1-a | RUNNING | my second vm via CLI |
+----------------------+-----------------+---------------+---------+----------------------+

  4. Connect to the VM:

    To connect via OS login, use the VM name:

    yc compute ssh \
  --name <VM_name>

    When connecting via OS Login, you can specify the VM ID instead of its name:

    yc compute ssh \
  --id <VM_ID>

    To connect via OS login by internal IP address, use the --internal-address parameter:

    yc compute ssh \
  --name <VM_name> \
  --internal-address

Connecting to a VM via OS Login using an SSH certificate over a standard SSH client

You can use a standard SSH client to connect to VMs with OS Login access enabled. To do this, export an OS Login certificate to your local computer and specify this certificate when connecting to a VM:

  1. Enable access via OS Login at the organization level.

    To connect to a VM via OS Login using an SSH certificate over a standard SSH client, enable Access via OS Login using SSH certificates (recommended).

  2. Get a list of all VMs in the default folder:

    yc compute instance list

    Result:

    +----------------------+-----------------+---------------+---------+---------------+--------------+
|          ID          |       NAME      |    ZONE ID    | STATUS  |  EXTERNAL IP  | INTERNAL IP  |
+----------------------+-----------------+---------------+---------+---------------+--------------+
| fhm0b28lgf********** | first-instance  | ru-central1-a | RUNNING | 158.160.**.** | 192.168.0.8  |
| fhm9gk85nj********** | second-instance | ru-central1-a | RUNNING | 51.250.**.*** | 192.168.0.12 |
+----------------------+-----------------+---------------+---------+---------------+--------------+

    1. Get a public address of the VM by specifying its ID:

      yc compute instance get \
    --id <VM_ID>
      Result:
      id: fhm0b28lgf**********
folder_id: b1gt6g8ht345********
created_at: "2023-12-09T06:23:04Z"
name: first-instance
zone_id: ru-central1-a
platform_id: standard-v3
resources:
  memory: "2147483648"
  cores: "2"
  core_fraction: "100"
status: RUNNING
metadata_options:
  gce_http_endpoint: ENABLED
  aws_v1_http_endpoint: ENABLED
  gce_http_token: ENABLED
  aws_v1_http_token: DISABLED
boot_disk:
  mode: READ_WRITE
  device_name: epd9m2csd95p********
  auto_delete: true
  disk_id: epd9m2csd95p********
network_interfaces:
  - index: "0"
    mac_address: d0:0d:87:75:**:**
    subnet_id: e2li9tcgi7ii********
    primary_v4_address:
      address: 192.168.0.8
      one_to_one_nat:
        address: 158.160.**.**
        ip_version: IPV4
gpu_settings: {}
fqdn: first-instance.ru-central1.internal
scheduling_policy: {}
network_settings:
  type: STANDARD
placement_policy: {}

      The VM's public address is stated in the network_interfaces.primary_v4_address.one_to_one_nat.address field.

  3. Connect to the VM:

    ssh -i <certificate_file_path> <username>@<VM_public_IP_address>

    Where:

    • <certificate_file_path>: Path to the previously saved Identity certificate file, e.g., /home/user1/.ssh/yc-cloud-id-b1gia87mbaom********-orgusername.
    • <username>: Organization user name. You can see the username at the end of the exported OS Login certificate. In the example above, it is orgusername.
    • <VM_public_IP_address>: VM's public IP address you got earlier.

    If this is your first time connecting to the VM, you will see an unknown host warning:

    The authenticity of host '158.160.**.** (158.160.**.**)' can't be established.
ECDSA key fingerprint is SHA256:PoaSwqxRc8g6iOXtiH7ayGHpSN0MXwUfWHk********.
Are you sure you want to continue connecting (yes/no)?

    Type yes in the terminal and press Enter.

Note

The certificate is valid for one hour. After this time has elapsed, you will need to export a new certificate to connect to the VM.

Connecting to a VM via OS Login using an SSH key over the YC CLI

You can use a custom SSH key to connect to VMs with OS Login access enabled. To do this, create an SSH key, add it to the organization user profile in Yandex Cloud Organization and specify the following when connecting:

  1. Enable access via OS Login at the organization level.

    To connect to a VM via OS Login using an SSH key over the YC CLI, enable Access via OS Login using SSH keys.

  2. Get a list of all VMs in the default folder:

    yc compute instance list

    Result:

    +----------------------+-----------------+---------------+---------+---------------+--------------+
|          ID          |       NAME      |    ZONE ID    | STATUS  |  EXTERNAL IP  | INTERNAL IP  |
+----------------------+-----------------+---------------+---------+---------------+--------------+
| fhm0b28lgf********** | first-instance  | ru-central1-a | RUNNING | 158.160.**.** | 192.168.0.8  |
| fhm9gk85nj********** | second-instance | ru-central1-a | RUNNING | 51.250.**.*** | 192.168.0.12 |
+----------------------+-----------------+---------------+---------+---------------+--------------+

  3. Connect to the VM:

    yc compute ssh \
  --name <VM_name> \
  --identity-file <path_to_private_SSH_key_file> \
  --login <username> \
  --internal-address

    Where:

    • --name: Previously obtained VM name. You can specify the VM ID instead of its name by using the --id parameter.
    • --identity-file: Path to the previously saved private SSH key file, e.g., /home/user1/.ssh/id_ed25519.
    • --login: OS Login username.
    • (Optional) --internal-address: To connect using an internal IP address.

You will connect to the specified virtual machine using your SSH key. If this is your first time connecting to this VM, a new user profile will be created in the VM's operating system.

See also

Previous
Exporting an OS Login certificate
Next
Working with Yandex Cloud from inside a VM
In this article: