[Yandex Cloud documentation](../../../index.md) > [Yandex Compute Cloud](../../index.md) > [Step-by-step guides](../index.md) > Using a VM > Connecting to a VM over SSH

# Connecting to a Linux VM over SSH

To connect to a [VM](../../concepts/vm.md) via SSH, you need a key pair with the public key located on the VM and the private key kept by the user. This method is more secure than connecting with a username and password.

To enable another user to connect to your VM, add an SSH key for them by following [this guide](#vm-authorized-keys).

{% note info %}

When creating a VM accessible via [OS Login](os-login.md), specify SSH keys in the [metadata](../../concepts/metadata/sending-metadata.md). This way, you will be able to [connect to the VM via SSH](#vm-connect) even if you disable OS Login access for it.

{% endnote %}

To connect to a Linux VM via SSH:

1. [Create an SSH key pair](#creating-ssh-keys).
1. [Copy the public key](#copy-key) to the **SSH key** field on the VM creation page.
1. [Connect to the VM](#vm-connect).


## Creating an SSH key pair {#creating-ssh-keys}

{% list tabs group=operating_system %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to [create](../vm-create/create-linux-vm.md) your VM.
  1. Navigate to **Compute Cloud**.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/server.svg) **Virtual machines**.
  1. Click **Create virtual machine**.
  1. Under **Access**, click **Add key**.
  1. In the window that opens, select `Generate key` and click **Add**.
  
      When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home/<user_name>/.ssh` directory. In Windows, unpack the archive to the `C:\Users\<user_name>/.ssh` directory. You do not need additionally enter the public key in the management console.
  
      The system will add the SSH key to your organization user profile. If the organization has [disabled](../../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.
  
  {% cut "UNPROTECTED PRIVATE KEY FILE warning" %}
      
  On Unix-like systems, after you unpack a private key to the `.ssh` directory, the key gets permissions that are too high. This causes the `UNPROTECTED PRIVATE KEY FILE` warning when connecting to the VM. To reduce the permissions, run this command:
  
  ```bash
  chmod 600 <path_to_private_key_file>
  ```
      
  {% endcut %}

- Linux/macOS {#linux-macos}

  1. Open the terminal.
  1. Use the `ssh-keygen` command to create a new key:
  
      ```bash
      ssh-keygen -t ed25519 -C "<optional_comment>"
      ```
  
      You can specify an empty string in the `-C` parameter to avoid adding a comment, or you may not specify the `-C` parameter at all: in this case, a default comment will be added.
  
      After running this command, you will be prompted to specify the name and path to the key files, as well as enter the password for the private key. If you only specify the name, the key pair will be created in the current directory. The public key will be saved in a file with the `.pub` extension, while the private key, in a file without extension.
  
      By default, the command prompts you to save the key under the `id_ed25519` name in the following directory: `/home/<username>/.ssh`. If there is already an SSH key named `id_ed25519` in this directory, you may accidentally overwrite it and lose access to the resources it is used in. Therefore, you may want to use unique names for all SSH keys.

- Windows 10/11 {#windows}

  If you do not have [OpenSSH](https://en.wikipedia.org/wiki/OpenSSH) installed yet, follow this [guide](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=gui) to install it.
  
  1. Run `cmd.exe` or `powershell.exe` (make sure to update PowerShell before doing so).
  1. Use the `ssh-keygen` command to create a new key:
  
      ```shell
      ssh-keygen -t ed25519 -C "<optional_comment>"
      ```
  
      You can specify an empty string in the `-C` parameter to avoid adding a comment, or you may not specify the `-C` parameter at all: in this case, a default comment will be added.
  
      After running this command, you will be prompted to specify the name and path to the key files, as well as enter the password for the private key. If you only specify the name, the key pair will be created in the current directory. The public key will be saved in a file with the `.pub` extension, while the private key, in a file without extension.
  
      By default, the command prompts you to save the key under the `id_ed25519` name in the following folder: `C:\Users\<username>/.ssh`. If there is already an SSH key named `id_ed25519` in this directory, you may accidentally overwrite it and lose access to the resources it is used in. Therefore, you may want to use unique names for all SSH keys.

- Windows 7/8 {#windows7-8}

  Create keys using the PuTTY app:
  
  1. [Download](https://www.putty.org) and install PuTTY.
  1. Add the folder with PuTTY to the `PATH` variable:
  
      1. Click **Start** and type **Change system environment variables** in the Windows search bar.
      1. Click **Environment Variables...** at the bottom right.
      1. In the window that opens, find the `PATH` parameter and click **Edit**.
      1. Add your folder path to the list.
      1. Click **OK**.
  
  1. Launch the PuTTYgen app.
  1. Select **EdDSA** as the pair type to generate. Click **Generate** and move the cursor in the field above it until key creation is complete.
  
      ![ssh_generate_key](../../../_assets/compute/ssh-putty/ssh_generate_key.png)
  
  1. In **Key passphrase**, enter a strong password. Enter it again in the field below.
  1. Click **Save private key** and save the private key. Do not share its key phrase with anyone.
  1. Click **Save public key** and save the public key to a file named `<key_name>.pub`.

{% endlist %}

{% note warning %}

Store your private key securely, as you will not be able to connect to the VM without it.

{% endnote %}

## Copying a public key to the clipboard {#copy-key}

The [previously created](#creating-ssh-keys) public key has the following format:

```text
<key_type> <public_key_body> <optional_comment>
```

Here is an example:

> ```text
> ssh-ed25519 AAAAC3NzaC1lZDI1NTE5ABFLIFyapYheN7OZNhTaNqEHefjmU5mtzK********+gRPCz user@Desktop
> ```

{% note tip %}

The `<optional_comment>` section is not used when connecting over SSH, so you can skip it.

{% endnote %}

Open the `<key_name>.pub` file using any text editor, such as Notepad, and copy the key from it. The key must be written as a single line (without returns or line breaks).

You can also copy the key using the command line:

{% list tabs group=operating_system %}

- Linux/macOS {#linux-macos}

  In the terminal, use one of the following methods to copy the key:

    * Manually. To do this, output the file content to the screen:

        ```bash
        cat <key_file_path>/<key_name>.pub
        ```

        This will display the public key. Copy it to the clipboard.

    * Use the appropriate command:

        * For Linux: `cat <key_file_path>/<key_name>.pub | xclip -selection clipboard`.
        * For macOS: `cat <key_file_path>/<key_name>.pub | pbcopy`.

        The above-mentioned commands copy the entire content of the file, including the optional comment.

- Windows {#windows}

  1. Run `cmd.exe` or `powershell.exe`.
  1. Use one of the following methods to copy the key:

      * Manually. To do this, output the file content to the screen:

          ```shell
          type <key_file_path>\<key_name>.pub
          ```

          This will display the public key. Copy it to the clipboard.

      * Use the appropriate command:

          ```shell
          type <key_file_path>\<key_name>.pub | clip
          ```

          The above-mentioned command copies the entire content of the file, including the optional comment.

{% endlist %}

After that, paste the public key into the **SSH key** field when creating a VM in the [management console](https://console.yandex.cloud).

## Connecting to a VM {#vm-connect}

You can connect to a VM with the `RUNNING` status over SSH. It may take some time for all services to initialize after the VM [starts](../vm-control/vm-stop-and-start.md#start). If you get a connection error, try again in a few minutes.

The VM [security groups](../../../vpc/concepts/security-groups.md) must allow incoming TCP traffic on port 22.

To connect, specify the VM [public IP address](../../../vpc/concepts/address.md#public-addresses). You can find out the public IP address in the management console: on the VM page, go to the **Network** section and find the **Public IPv4 address** field. If you created your VM with an internal IP address only, [assign it a public IP address](../vm-control/vm-attach-public-ip.md).

You can also use [internal IP addresses](../../../vpc/concepts/address.md#internal-addresses) and [FQDNs](../../../vpc/concepts/address.md#fqdn) to establish an SSH connection between VMs within a single [cloud network](../../../vpc/concepts/network.md#network) in Yandex Cloud.

{% list tabs group=operating_system %}

- Linux/macOS {#linux-macos}

  In the terminal, run this command:

  ```bash
  ssh <username>@<VM_public_IP_address>
  ```

  Where:
  * `<user_name>`: VM account user name. If you created your VM via the CLI, `yc-user` is the default user.
  * `<VM_public_IP_address>`: VM [public IP address](../../../vpc/concepts/address.md#public-addresses) for internet access.
  
      You can learn the public IP address of a VM from the **Public IPv4 address** field of the network interface under **Network** on the VM page in the [management console](https://console.yandex.cloud) or by using the `yc compute instance get <VM_name>` [YC CLI](../../../cli/quickstart.md) command.

  If you have multiple private keys, specify the one you need:

  ```bash
  ssh -i <key_path/key_file_name> <username>@<VM_public_IP_address>
  ```

  If this is your first time connecting to the VM, you will get this unknown host warning:

  ```text
  The authenticity of host '51.250.83.243 (51.250.83.243)' can't be established.
  ED25519 key fingerprint is SHA256:6Mjv93NJDCaf/vu3NYwiLQK4tKI+4cfLtkd********.
  This key is not known by any other names.
  Are you sure you want to continue connecting (yes/no/[fingerprint])?
  ```

  Type `yes` into the terminal and press **Enter**.

- Windows 10/11 {#windows}

  Make sure the Windows account has read access to the key folder.

  To connect to the VM, run the following command in the command line:

  ```shell
  ssh <username>@<VM_public_IP_address>
  ```

  Where:
  
  * `<user_name>`: VM account user name. If you created your VM via the CLI, `yc-user` is the default user.
  * `<VM_public_IP_address>`: VM [public IP address](../../../vpc/concepts/address.md#public-addresses) for internet access.

      You can learn the public IP address of a VM from the **Public IPv4 address** field of the network interface under **Network** on the VM page in the [management console](https://console.yandex.cloud) or by using the `yc compute instance get <VM_name>` [YC CLI](../../../cli/quickstart.md) command.

  If you have multiple private keys, specify the one you need:

  ```shell
  ssh -i <key_path\key_file_name> <user_name>@<VM_public_IP_address>
  ```

  If this is your first time connecting to the VM, you will get this unknown host warning:

  ```text
  The authenticity of host '89.169.132.223 (89.169.132.223)' can't be established.
  ECDSA key fingerprint is SHA256:DfjfFB+in0q0MGi0HnqLNMdHssLfm1yRanB********.
  Are you sure you want to continue connecting (yes/no/[fingerprint])?
  ```

  Type `yes` in the command line and press **Enter**.

- Windows 7/8 {#windows7-8}

  Establish a connection using PuTTY:
  1. Run Pageant.
     1. Right-click the Pageant icon in the task bar.
     1. In the context menu, select **Add key**.
     1. Select a PuTTY-generated private key in `.ppk` format. Enter the password for this key, if it is set.
  1. Run PuTTY.
     1. In the **Host Name (or IP address)** field, enter the [public IP address](../../../vpc/concepts/address.md#public-addresses) of the VM you want to connect to. Specify port `22` and **SSH** connection type.
        
        You can learn the public IP address of a VM from the **Public IPv4 address** field of the network interface under **Network** on the VM page in the [management console](https://console.yandex.cloud) or by using the `yc compute instance get <VM_name>` [YC CLI](../../../cli/quickstart.md) command.

        ![ssh_add_ip](../../../_assets/compute/ssh-putty/ssh_add_ip.png)

     1. In the tree on the left, select **Connection** → **SSH** → **Auth**.
     1. Enable **Allow agent forwarding**.

        ![ssh_choose_private_key](../../../_assets/compute/ssh-putty/authentication_parameters.png)

     1. In the tree on the left, select **Connection** → **SSH** → **Auth** → **Credentials**.

     1. In the **Private key file for authentication** field, select the private key file.

        ![ssh_choose_private_key](../../../_assets/compute/ssh-putty/ssh_choose_private_key.png)

     1. Go back to the **Sessions** menu. In the **Saved sessions** field, enter any name for the session and click **Save**. This will save the session settings under the specified name. You can use this session profile to connect with Pageant.

        ![ssh_save_session](../../../_assets/compute/ssh-putty/ssh_save_session.png)

     1. Click **Open**. If this is your first time connecting to the VM, you may get this unknown host warning:

        ![ssh_unknown_host_warning](../../../_assets/compute/ssh-putty/ssh_unknown_host_warning.png)

        Click **Accept**. This will open a terminal window prompting you to enter the username to use for connection. Type the username you specified when creating the VM and press **Enter**. If you created your VM via the CLI, `yc-user` is the default user.

        If everything is configured correctly, a connection to the server will be established.

        ![ssh_login](../../../_assets/compute/ssh-putty/ssh_login.png)

  If you saved the session profile in PuTTY, you can use Pageant for future connections:
  1. Right-click the Pageant icon in the task bar.
  1. Select **Saved sessions**.
  1. In the saved sessions list, select the session you need.

- Yandex Cloud Shell {#console}

  1. On the left-hand panel in the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/dots-9.svg) **All services** and select **Compute Cloud**, or find it using the search bar on the dashboard.
  1. Navigate to the VM you want to connect to.
  1. Make sure its status is `Running`. If the VM is idle, click ![image](../../../_assets/console-icons/play.svg) **Start** in the top-right corner and wait until its status changes to `Running`.
  1. Click ![image](../../../_assets/console-icons/terminal.svg) **Connect in Cloud Shell** at the top right.
  1. Enter a username. The default login is the one specified when creating the VM.
  1. Paste the contents of the public SSH key file or upload the file.
  1. Click **Connect**.
  
  This will open the ![image](../../../_assets/console-icons/terminal.svg) **Cloud Shell** terminal at the bottom with an established connection to the VM over SSH.
  
  To close the connection, click ![image](../../../_assets/console-icons/xmark.svg) or use the `exit` command.

{% endlist %}

For more information on how to solve connection issues, see [FAQ](../../qa/connection.md).

## Adding SSH keys for other users {#vm-authorized-keys}

You can add SSH keys for another VM user. To do this, create a new user and add a file with the authorized keys for this user.

To create multiple users with keys at the same time, use [metadata](../../concepts/metadata/sending-metadata.md).

To configure users from within the VM, follow these steps:

1. [Connect](#vm-connect) to the VM under the username you specified when creating the VM in the management console.

    {% note info %}

    To get info on a VM with custom metadata, run this command:

    ```bash
    yc compute instance get --full <VM_name>
    ```

    {% endnote %}

1. Create a new user named `testuser` and specify `bash` as the default shell for this user:

    ```bash
    sudo useradd -m -d /home/testuser -s /bin/bash testuser
    ```

1. Switch to the new user:

    ```bash
    sudo su - testuser
    ```

1. Create a folder named `.ssh` in the new user's home directory:

    ```bash
    mkdir .ssh
    ```

1. In the `.ssh` folder, create a file named `authorized_keys`:

    ```bash
    touch .ssh/authorized_keys
    ```

1. Add the new user's public key to the `authorized_keys` file:

    ```bash
    echo "<public_key>" >> /home/testuser/.ssh/authorized_keys
    ```

    Where `<public_key>` is the contents of the [public key](#creating-ssh-keys) file for SSH access to the VM.

1. Update access permissions for the `authorized_keys` file and `.ssh` folder:

    ```bash
    chmod 700 ~/.ssh
    chmod 600 ~/.ssh/authorized_keys
    ```

1. Disconnect from the VM by running `exit`.
1. [Restart the VM](../vm-control/vm-stop-and-start.md#restart).
1. Check the connection for the new user:

   ```bash
   ssh testuser@<VM_public_IP_address>
   ```

   Where `<VM_public_IP_address>` is the VM's [public IP address](../../../vpc/concepts/address.md#public-addresses) for internet access.

   You can learn the public IP address of a VM from the **Public IPv4 address** field of the network interface under **Network** on the VM page in the [management console](https://console.yandex.cloud) or by using the `yc compute instance get <VM_name>` [YC CLI](../../../cli/quickstart.md) command.

#### What's next {#what-is-next}

* [Using Yandex Cloud from within a VM](auth-inside-vm.md)

#### See also {#see-also}

* [Connecting to a Linux VM over SSH using Yandex Cloud Shell](cloud-shell.md)
* [Connecting to a Windows VM via RDP](rdp.md)
* [Connecting to a Windows VM via PowerShell](powershell.md)
* [Connecting to a VM via OS Login](os-login.md)