[Yandex Cloud documentation](../../index.md) > [Yandex Compute Cloud](../index.md) > [Getting started](index.md) > Creating a Linux VM

# Creating a Linux VM

Create a Linux [VM](../concepts/vm.md) in the Yandex Cloud management console using Compute Cloud and connect to it.

## Getting started {#before-you-begin}

To get started in Yandex Cloud:
1. Log in to the [management console](https://console.yandex.cloud). If not signed up yet, navigate to the management console and follow the on-screen instructions.
1. In [Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts), make sure you have a [billing account](../../billing/concepts/billing-account.md) linked and its status is `ACTIVE` or `TRIAL_ACTIVE`. If you do not have a billing account yet, [create one](../../billing/quickstart/index.md#create_billing_account).
1. If you do not have a folder yet, [create one](../../resource-manager/operations/folder/create.md).
1. If you do not have an SSH key pair yet, [create one](../operations/vm-connect/ssh.md#creating-ssh-keys).

## Create a VM {#create-vm}

{% note info %}

To create, modify, and edit a [VM](../concepts/vm.md), you need the `compute.editor` _minimum_ [role](../security/index.md#compute-editor) for the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). To create a VM with a licensed image, you will additionally need the `license-manager.viewer` [role](../../marketplace/security/index.md#license-manager-viewer).

To create a VM with a [public IP address](../../vpc/concepts/address.md#public-addresses), you will additionally need the `vpc.publicAdmin` [role](../../vpc/security/index.md#vpc-public-admin).

{% endnote %}

1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create your VM.
1. Navigate to **Compute Cloud**.
1. In the left-hand panel, select ![image](../../_assets/console-icons/server.svg) **Virtual machines**.
1. Click **Create virtual machine**.
1. Under **Boot disk image**, select an [image](../concepts/image.md) and a Linux-based OS version.

    To create a VM from an existing boot disk, go to the **Custom** tab and select the boot disk you need. To update disk settings, click ![image](../../_assets/console-icons/pencil.svg) next to the disk name.

1. Under **Location**, select the [availability zone](../../overview/concepts/geo-scope.md) where your VM will reside.
1. Optionally, configure the boot [disk](../concepts/disk.md) under **Disks and file storages**:

    * Select the [disk type](../concepts/disk.md#disks_types).
    * Specify the required disk size.
    * Optionally, to [encrypt](../concepts/encryption.md) a boot disk or a secondary disk, under **Disks and file storages**, click ![image](../../_assets/console-icons/pencil.svg) to the right of the disk name and configure encryption parameters for the disk:
      
      * Select **Encrypted disk**.
      * In the **KMS key** field, select the [key](../../kms/concepts/key.md) you want to use to encrypt the disk. To [create](../../kms/operations/key.md#create) a new key, click **Create**.
      
      To create an encrypted disk, you need the `kms.keys.user` [role](../../kms/security/index.md#kms-keys-user) or higher.
      
      {% note warning %}
      
      You can specify encryption settings only when creating a disk. You cannot disable or change disk encryption. You also cannot enable encryption for an existing disk.
      
      {% endnote %}
      
      If you deactivate the key used to encrypt a disk, image, or snapshot, access to the data will be suspended until you reactivate the key.
      
      {% note alert %}
      
      If you destroy the key or its [version](../../kms/concepts/version.md) used to encrypt a disk, image, or snapshot, you will irrevocably lose access to the data. For details, see [Destroying key version](../../kms/concepts/version.md#version-distruct).
      
      {% endnote %}

        If you are creating a VM instance from an existing boot disk, update the settings of that disk in the **Custom** tab under **Boot disk image** at the top of the form.

1. Optionally, add a secondary [disk](../concepts/disk.md):
   
   * Under **Disks and file storages**, click **Add**.
   * In the window that opens, select **Disk**. You can select an existing disk or create a new one, either empty or from a snapshot or image.
   
       For example, to create a new empty disk:
   
       * Select `Create new`.
       * In the **Contents** field, select `Empty`.
       * Enter a name for the disk.
       * Select the [disk type](../concepts/disk.md#disks_types).
       * Specify the required disk and block size.
       * Optionally, enable **Additional** in the **Delete along with the virtual machine** field if you need this disk automatically deleted when deleting the VM.
       * Click **Add disk**.
1. Optionally, connect a [file storage](../concepts/filesystem.md):
   
   * Under **Disks and file storages**, click **Add**.
   
       * In the window that opens, select **File storage** and choose the storage you want to connect from the list.
   
       * Click **Add file storage**.
1. Under **Computing resources**, select one of the preset configurations or create a custom one. To create a custom configuration:
   
   * Go to the **Custom** tab.
   * Select a [platform](../concepts/vm-platforms.md).
   * Specify the [guaranteed performance](../concepts/performance-levels.md) and required number of vCPUs, as well as RAM size.
   * Enable a [software-accelerated network](../concepts/software-accelerated-network.md) if needed.
   * Make your VM [preemptible](../concepts/preemptible-vm.md), if required.
1. Under **Network settings**:
   
   * In the **Subnet** field, enter the ID of a subnet in the new VM’s availability zone. Alternatively, select a [cloud network](../../vpc/concepts/network.md#network) from the list.
   
       * Each network must have at least one [subnet](../../vpc/concepts/network.md#subnet). If your network has no subnets, create one by selecting **Create subnet**.
       * If there are no networks in the list, click **Create network** to create one:
   
           * In the window that opens, specify the network name and select the folder where it will be created.
           * Optionally, enable the **Create subnets** setting to automatically create subnets in all availability zones.
           * Click **Create network**.
   
   * In the **Public IP address** field, select the IP address assignment method:
   
       * `Auto`: To assign a random IP address from the Yandex Cloud IP address pool. In this case, you can enable [DDoS protection](../../vpc/ddos-protection/index.md) using the option below.
       * `List`: To select a public IP address from the list of previously reserved static addresses. For more information, see [Converting a dynamic public IP address to static](../../vpc/operations/set-static-ip.md).
       * `No address`: Do not assign a public IP address.
   
   * Select [relevant security groups](../../vpc/concepts/security-groups.md):
   
       * To connect to a virtual machine over `SSH`, the security group must allow incoming network traffic over `TCP` and `UDP` on port `22`.
   
       * To connect to a virtual machine over `RDP`, the security group must allow incoming network traffic over `TCP` and `UDP` on port `3389`.
       
       If you leave the field empty, the virtual machine will be automatically assigned the [default security group](../../vpc/concepts/security-groups.md#default-security-group) allowing connections to the VM over `SSH` and `RDP`.
   
   * Expand **Additional** and select a method for assigning internal addresses in the **Internal IPv4 address** field:
   
       * `Auto`: To assign a random IP address from the pool of IP addresses available in the selected subnet.
       * `Manual`: To manually assign a private IP address to the VM.
       * Enable **DDoS protection**, if required. The option is available if you previously selected the automatic IP assignment method in the public address settings.
   
   * Optionally, create records for your VM in the [DNS zone](../../dns/concepts/dns-zone.md):
   
       * Expand **DNS settings for internal addresses** and click **Add record**.
       * Specify a zone, FQDN, and TTL for the record. When setting the FQDN, you can enable `Detect automatically` for the zone.
         You can add multiple records to [internal DNS zones](../../dns/concepts/dns-zone.md). For more information, see [Yandex Cloud DNS integration with Yandex Compute Cloud](../../dns/concepts/compute-integration.md).
       * To create another record, click **Add record**.
   
   If you want to add another [network interface](../concepts/network.md) to your VM, click **Add network interface** and repeat the settings from this step for the new interface. You can add up to eight network interfaces to a single VM.
1. Under **Access**:
   
   * Select **Access by OS Login** to [connect](../operations/vm-connect/os-login.md) and manage access to the new VM using [OS Login](../../organization/concepts/os-login.md) in Yandex Identity Hub.
   
       With OS Login, you can connect to VMs using SSH keys and SSH certificates via a standard SSH client or the [Yandex Cloud CLI](../../cli/quickstart.md). OS Login enables rotating the SSH keys used to access VMs, providing the most [secure](../../security/domains/iaas-checklist.md#vm-security) access option.
   
   * If you prefer not to use OS Login, select **SSH key** and specify the following VM access data:
   
       * In the **Login** field, enter the username.
   
           {% note alert %}
   
           Do not use `root` or other [OS-reserved usernames](https://github.com/canonical/subiquity/blob/main/reserved-usernames). To perform operations requiring root privileges, use the `sudo` command.
   
           {% endnote %}
   
       * In the **SSH key** field, select the SSH key saved in your [organization user](../../organization/concepts/membership.md) profile.
         
         If there are no SSH keys in your profile or you want to add a new key:
         
         1. Click **Add key**.
         1. Enter a name for the SSH key.
         1. Select one of the following:
         
             * `Enter manually`: Paste the contents of the public SSH key. You need to [create](../operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own.
             * `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own.
             * `Generate key`: Automatically create an SSH key pair.
             
               When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home/<user_name>/.ssh` directory. In Windows, unpack the archive to the `C:\Users\<user_name>/.ssh` directory. You do not need additionally enter the public key in the management console.
         
         1. Click **Add**.
         
         The system will add the SSH key to your organization user profile. If the organization has [disabled](../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.
   
   If you want to add multiple users with SSH keys to the VM at the same time, [specify](../concepts/metadata/sending-metadata.md) these users' data under **Metadata**. You can also use metadata to [install additional software](../operations/vm-create/create-with-cloud-init-scripts.md) on a VM when creating it.
   
   In public Linux images provided by Yandex Cloud, the functionality of connecting over SSH using login and password is disabled by default.
1. Optionally, enable the **Backup** option and, in the **Backup policies** field, select or create a [backup policy](../../backup/concepts/policy.md) to back up your VMs automatically using [Cloud Backup](../../backup/index.md).
   
   To create a new VM with a Cloud Backup connection, your account must have the `backup.user` [role](../../backup/security/index.md#backup-user) or higher for the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you are creating the VM in.
   
   {% note info %}
   
   If your account does not have the `backup.user` role or higher, you can connect the VM to Cloud Backup using a [service account](../../iam/concepts/users/service-accounts.md) which has that role. 
   
   To do this, expand the **Additional** section and select the service account under **Service account**. If required, [create](../../iam/operations/sa/create.md) a new service account and [assign](../../iam/operations/sa/assign-role-for-sa.md) it the `backup.user` [role](../../backup/security/index.md#backup-user).
   
   {% endnote %}
   
   {% note tip %}
   
   Installing a Cloud Backup agent is a resource-intensive operation. If you want to use a VM in the minimum possible configuration or, for example, a VM with a [vCPU performance level](../concepts/performance-levels.md) below 100%, we recommend increasing the VM's resources during the Cloud Backup agent installation.
   
   {% endnote %}
   
   For more information, see [Connecting Compute Cloud VMs and Yandex BareMetal servers to Cloud Backup](../../backup/concepts/vm-connection.md).    
1. Under **General information**, enter a name for your VM:

    * Length: between 3 and 63 characters.
    * It can only contain lowercase Latin letters, numbers, and hyphens.
    * It must start with a letter and cannot end with a hyphen.

    {% note info %}
    
    The VM name is used to generate an [internal FQDN](../concepts/network.md#hostname), which is set only once, when you create the VM. If the internal FQDN is important to you, make sure to choose an appropriate name for your VM.
    
    {% endnote %}

1. Under **Additional**:
   
   * Optionally, select or create a [service account](../../iam/concepts/users/service-accounts.md). With a service account, you can flexibly configure access permissions for your resources.
   * Optionally, enable access to the [serial console](../concepts/serial-console.md).
   * Optionally, to configure delivering [Linux metrics](../../monitoring/operations/unified-agent/linux_metrics.md) and any additional metrics from your apps, enable **Monitoring** under **Agent for delivering metrics** and select:
     * **Yandex Monitoring**: [Install an agent](../../monitoring/concepts/data-collection/unified-agent/index.md) to collect additional metrics from VM instances and apps.
     * **Yandex Managed Service for Prometheus®**: [Install and configure an agent](../../monitoring/operations/prometheus/ingestion/prometheus-agent.md) to collect additional metrics from VM instances and apps in Prometheus format:
        * Select or create a workspace to store your metrics.
        * Optionally, describe the [delivery parameters](../../monitoring/operations/prometheus/ingestion/prometheus-agent.md) for your custom metrics, in JSON format.
   * Optionally, under **Placement**, select a VM [placement group](../concepts/placement-groups.md).
1. Click **Create VM**.

The VM will appear in the list. Every new VM gets an [IP address](../../vpc/concepts/address.md) and [host name](../../vpc/concepts/address.md#fqdn) (FQDN).

_© 2025 Linux Foundation. All rights reserved. The Linux Foundation owns and uses registered trademarks. For a list of Linux Foundation trademarks, see [Trademark Usage](https://www.linuxfoundation.org/legal/trademark-usage)._

## Connect to the VM {#connect-to-vm}

# Connecting to a Linux VM over SSH

To connect to a [VM](../concepts/vm.md) via SSH, you need a key pair with the public key located on the VM and the private key kept by the user. This method is more secure than connecting with a username and password.

To enable another user to connect to your VM, add an SSH key for them by following [this guide](#vm-authorized-keys).

{% note info %}

When creating a VM accessible via [OS Login](../operations/vm-connect/os-login.md), specify SSH keys in the [metadata](../concepts/metadata/sending-metadata.md). This way, you will be able to [connect to the VM via SSH](#vm-connect) even if you disable OS Login access for it.

{% endnote %}

To connect to a Linux VM via SSH:

1. [Create an SSH key pair](#creating-ssh-keys).
1. [Copy the public key](#copy-key) to the **SSH key** field on the VM creation page.
1. [Connect to the VM](#vm-connect).


## Creating an SSH key pair {#creating-ssh-keys}

{% list tabs group=operating_system %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to [create](../operations/vm-create/create-linux-vm.md) your VM.
  1. Navigate to **Compute Cloud**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/server.svg) **Virtual machines**.
  1. Click **Create virtual machine**.
  1. Under **Access**, click **Add key**.
  1. In the window that opens, select `Generate key` and click **Add**.
  
      When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home/<user_name>/.ssh` directory. In Windows, unpack the archive to the `C:\Users\<user_name>/.ssh` directory. You do not need additionally enter the public key in the management console.
  
      The system will add the SSH key to your organization user profile. If the organization has [disabled](../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.
  
  {% cut "UNPROTECTED PRIVATE KEY FILE warning" %}
      
  On Unix-like systems, after you unpack a private key to the `.ssh` directory, the key gets permissions that are too high. This causes the `UNPROTECTED PRIVATE KEY FILE` warning when connecting to the VM. To reduce the permissions, run this command:
  
  ```bash
  chmod 600 <path_to_private_key_file>
  ```
      
  {% endcut %}

- Linux/macOS {#linux-macos}

  1. Open the terminal.
  1. Use the `ssh-keygen` command to create a new key:
  
      ```bash
      ssh-keygen -t ed25519 -C "<optional_comment>"
      ```
  
      You can specify an empty string in the `-C` parameter to avoid adding a comment, or you may not specify the `-C` parameter at all: in this case, a default comment will be added.
  
      After running this command, you will be prompted to specify the name and path to the key files, as well as enter the password for the private key. If you only specify the name, the key pair will be created in the current directory. The public key will be saved in a file with the `.pub` extension, while the private key, in a file without extension.
  
      By default, the command prompts you to save the key under the `id_ed25519` name in the following directory: `/home/<username>/.ssh`. If there is already an SSH key named `id_ed25519` in this directory, you may accidentally overwrite it and lose access to the resources it is used in. Therefore, you may want to use unique names for all SSH keys.

- Windows 10/11 {#windows}

  If you do not have [OpenSSH](https://en.wikipedia.org/wiki/OpenSSH) installed yet, follow this [guide](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=gui) to install it.
  
  1. Run `cmd.exe` or `powershell.exe` (make sure to update PowerShell before doing so).
  1. Use the `ssh-keygen` command to create a new key:
  
      ```shell
      ssh-keygen -t ed25519 -C "<optional_comment>"
      ```
  
      You can specify an empty string in the `-C` parameter to avoid adding a comment, or you may not specify the `-C` parameter at all: in this case, a default comment will be added.
  
      After running this command, you will be prompted to specify the name and path to the key files, as well as enter the password for the private key. If you only specify the name, the key pair will be created in the current directory. The public key will be saved in a file with the `.pub` extension, while the private key, in a file without extension.
  
      By default, the command prompts you to save the key under the `id_ed25519` name in the following folder: `C:\Users\<username>/.ssh`. If there is already an SSH key named `id_ed25519` in this directory, you may accidentally overwrite it and lose access to the resources it is used in. Therefore, you may want to use unique names for all SSH keys.

- Windows 7/8 {#windows7-8}

  Create keys using the PuTTY app:
  
  1. [Download](https://www.putty.org) and install PuTTY.
  1. Add the folder with PuTTY to the `PATH` variable:
  
      1. Click **Start** and type **Change system environment variables** in the Windows search bar.
      1. Click **Environment Variables...** at the bottom right.
      1. In the window that opens, find the `PATH` parameter and click **Edit**.
      1. Add your folder path to the list.
      1. Click **OK**.
  
  1. Launch the PuTTYgen app.
  1. Select **EdDSA** as the pair type to generate. Click **Generate** and move the cursor in the field above it until key creation is complete.
  
      ![ssh_generate_key](../../_assets/compute/ssh-putty/ssh_generate_key.png)
  
  1. In **Key passphrase**, enter a strong password. Enter it again in the field below.
  1. Click **Save private key** and save the private key. Do not share its key phrase with anyone.
  1. Click **Save public key** and save the public key to a file named `<key_name>.pub`.

{% endlist %}

{% note warning %}

Store your private key securely, as you will not be able to connect to the VM without it.

{% endnote %}

## Copying a public key to the clipboard {#copy-key}

The [previously created](#creating-ssh-keys) public key has the following format:

```text
<key_type> <public_key_body> <optional_comment>
```

Here is an example:

> ```text
> ssh-ed25519 AAAAC3NzaC1lZDI1NTE5ABFLIFyapYheN7OZNhTaNqEHefjmU5mtzK********+gRPCz user@Desktop
> ```

{% note tip %}

The `<optional_comment>` section is not used when connecting over SSH, so you can skip it.

{% endnote %}

Open the `<key_name>.pub` file using any text editor, such as Notepad, and copy the key from it. The key must be written as a single line (without returns or line breaks).

You can also copy the key using the command line:

{% list tabs group=operating_system %}

- Linux/macOS {#linux-macos}

  In the terminal, use one of the following methods to copy the key:

    * Manually. To do this, output the file content to the screen:

        ```bash
        cat <key_file_path>/<key_name>.pub
        ```

        This will display the public key. Copy it to the clipboard.

    * Use the appropriate command:

        * For Linux: `cat <key_file_path>/<key_name>.pub | xclip -selection clipboard`.
        * For macOS: `cat <key_file_path>/<key_name>.pub | pbcopy`.

        The above-mentioned commands copy the entire content of the file, including the optional comment.

- Windows {#windows}

  1. Run `cmd.exe` or `powershell.exe`.
  1. Use one of the following methods to copy the key:

      * Manually. To do this, output the file content to the screen:

          ```shell
          type <key_file_path>\<key_name>.pub
          ```

          This will display the public key. Copy it to the clipboard.

      * Use the appropriate command:

          ```shell
          type <key_file_path>\<key_name>.pub | clip
          ```

          The above-mentioned command copies the entire content of the file, including the optional comment.

{% endlist %}

After that, paste the public key into the **SSH key** field when creating a VM in the [management console](https://console.yandex.cloud).

## Connecting to a VM {#vm-connect}

You can connect to a VM with the `RUNNING` status over SSH. It may take some time for all services to initialize after the VM [starts](../operations/vm-control/vm-stop-and-start.md#start). If you get a connection error, try again in a few minutes.

The VM [security groups](../../vpc/concepts/security-groups.md) must allow incoming TCP traffic on port 22.

To connect, specify the VM [public IP address](../../vpc/concepts/address.md#public-addresses). You can find out the public IP address in the management console: on the VM page, go to the **Network** section and find the **Public IPv4 address** field. If you created your VM with an internal IP address only, [assign it a public IP address](../operations/vm-control/vm-attach-public-ip.md).

You can also use [internal IP addresses](../../vpc/concepts/address.md#internal-addresses) and [FQDNs](../../vpc/concepts/address.md#fqdn) to establish an SSH connection between VMs within a single [cloud network](../../vpc/concepts/network.md#network) in Yandex Cloud.

{% list tabs group=operating_system %}

- Linux/macOS {#linux-macos}

  In the terminal, run this command:

  ```bash
  ssh <username>@<VM_public_IP_address>
  ```

  Where:
  * `<user_name>`: VM account user name. If you created your VM via the CLI, `yc-user` is the default user.
  * `<VM_public_IP_address>`: VM [public IP address](../../vpc/concepts/address.md#public-addresses) for internet access.
  
      You can learn the public IP address of a VM from the **Public IPv4 address** field of the network interface under **Network** on the VM page in the [management console](https://console.yandex.cloud) or by using the `yc compute instance get <VM_name>` [YC CLI](../../cli/quickstart.md) command.

  If you have multiple private keys, specify the one you need:

  ```bash
  ssh -i <key_path/key_file_name> <username>@<VM_public_IP_address>
  ```

  If this is your first time connecting to the VM, you will get this unknown host warning:

  ```text
  The authenticity of host '51.250.83.243 (51.250.83.243)' can't be established.
  ED25519 key fingerprint is SHA256:6Mjv93NJDCaf/vu3NYwiLQK4tKI+4cfLtkd********.
  This key is not known by any other names.
  Are you sure you want to continue connecting (yes/no/[fingerprint])?
  ```

  Type `yes` into the terminal and press **Enter**.

- Windows 10/11 {#windows}

  Make sure the Windows account has read access to the key folder.

  To connect to the VM, run the following command in the command line:

  ```shell
  ssh <username>@<VM_public_IP_address>
  ```

  Where:
  
  * `<username>`: VM account user name. If you created your VM via the CLI, `yc-user` is the default user.
  * `<VM_public_IP_address>`: VM [public IP address](../../vpc/concepts/address.md#public-addresses) for internet access.

      You can learn the public IP address of a VM from the **Public IPv4 address** field of the network interface under **Network** on the VM page in the [management console](https://console.yandex.cloud) or by using the `yc compute instance get <VM_name>` [YC CLI](../../cli/quickstart.md) command.

  If you have multiple private keys, specify the one you need:

  ```shell
  ssh -i <key_path\key_file_name> <username>@<VM_public_IP_address>
  ```

  If this is your first time connecting to the VM, you will get this unknown host warning:

  ```text
  The authenticity of host '89.169.132.223 (89.169.132.223)' can't be established.
  ECDSA key fingerprint is SHA256:DfjfFB+in0q0MGi0HnqLNMdHssLfm1yRanB********.
  Are you sure you want to continue connecting (yes/no/[fingerprint])?
  ```

  Type `yes` in the command line and press **Enter**.

- Windows 7/8 {#windows7-8}

  Establish a connection using PuTTY:
  1. Run Pageant.
     1. Right-click the Pageant icon in the task bar.
     1. In the context menu, select **Add key**.
     1. Select a PuTTY-generated private key in `.ppk` format. Enter the password for this key, if it is set.
  1. Run PuTTY.
     1. In the **Host Name (or IP address)** field, enter the [public IP address](../../vpc/concepts/address.md#public-addresses) of the VM you want to connect to. Specify port `22` and **SSH** connection type.
        
        You can learn the public IP address of a VM from the **Public IPv4 address** field of the network interface under **Network** on the VM page in the [management console](https://console.yandex.cloud) or by using the `yc compute instance get <VM_name>` [YC CLI](../../cli/quickstart.md) command.

        ![ssh_add_ip](../../_assets/compute/ssh-putty/ssh_add_ip.png)

     1. In the tree on the left, select **Connection** → **SSH** → **Auth**.
     1. Enable **Allow agent forwarding**.

        ![ssh_choose_private_key](../../_assets/compute/ssh-putty/authentication_parameters.png)

     1. In the tree on the left, select **Connection** → **SSH** → **Auth** → **Credentials**.

     1. In the **Private key file for authentication** field, select the private key file.

        ![ssh_choose_private_key](../../_assets/compute/ssh-putty/ssh_choose_private_key.png)

     1. Go back to the **Sessions** menu. In the **Saved sessions** field, enter any name for the session and click **Save**. This will save the session settings under the specified name. You can use this session profile to connect with Pageant.

        ![ssh_save_session](../../_assets/compute/ssh-putty/ssh_save_session.png)

     1. Click **Open**. If this is your first time connecting to the VM, you may get this unknown host warning:

        ![ssh_unknown_host_warning](../../_assets/compute/ssh-putty/ssh_unknown_host_warning.png)

        Click **Accept**. This will open a terminal window prompting you to enter the username to use for connection. Type the username you specified when creating the VM and press **Enter**. If you created your VM via the CLI, `yc-user` is the default user.

        If everything is configured correctly, a connection to the server will be established.

        ![ssh_login](../../_assets/compute/ssh-putty/ssh_login.png)

  If you saved the session profile in PuTTY, you can use Pageant for future connections:
  1. Right-click the Pageant icon in the task bar.
  1. Select **Saved sessions**.
  1. In the saved sessions list, select the session you need.

- Yandex Cloud Shell {#console}

  1. On the left-hand panel in the [management console](https://console.yandex.cloud), click ![image](../../_assets/console-icons/dots-9.svg) **All services** and select **Compute Cloud**, or find it using the search bar on the dashboard.
  1. Navigate to the VM you want to connect to.
  1. Make sure its status is `Running`. If the VM is idle, click ![image](../../_assets/console-icons/play.svg) **Start** in the top-right corner and wait until its status changes to `Running`.
  1. Click ![image](../../_assets/console-icons/terminal.svg) **Connect in Cloud Shell** at the top right.
  1. Enter a username. The default login is the one specified when creating the VM.
  1. Paste the contents of the public SSH key file or upload the file.
  1. Click **Connect**.
  
  This will open the ![image](../../_assets/console-icons/terminal.svg) **Cloud Shell** terminal at the bottom with an established connection to the VM over SSH.
  
  To close the connection, click ![image](../../_assets/console-icons/xmark.svg) or use the `exit` command.

{% endlist %}

For more information on how to solve connection issues, see [FAQ](../qa/connection.md).

## Adding SSH keys for other users {#vm-authorized-keys}

You can add SSH keys for another VM user. To do this, create a new user and add a file with the authorized keys for this user.

To create multiple users with keys at the same time, use [metadata](../concepts/metadata/sending-metadata.md).

To configure users from within the VM, follow these steps:

1. [Connect](#vm-connect) to the VM under the username you specified when creating the VM in the management console.

    {% note info %}

    To get info on a VM with custom metadata, run this command:

    ```bash
    yc compute instance get --full <VM_name>
    ```

    {% endnote %}

1. Create a new user named `testuser` and specify `bash` as the default shell for this user:

    ```bash
    sudo useradd -m -d /home/testuser -s /bin/bash testuser
    ```

1. Switch to the new user:

    ```bash
    sudo su - testuser
    ```

1. Create a folder named `.ssh` in the new user's home directory:

    ```bash
    mkdir .ssh
    ```

1. In the `.ssh` folder, create a file named `authorized_keys`:

    ```bash
    touch .ssh/authorized_keys
    ```

1. Add the new user's public key to the `authorized_keys` file:

    ```bash
    echo "<public_key>" >> /home/testuser/.ssh/authorized_keys
    ```

    Where `<public_key>` is the contents of the [public key](#creating-ssh-keys) file for SSH access to the VM.

1. Update access permissions for the `authorized_keys` file and `.ssh` folder:

    ```bash
    chmod 700 ~/.ssh
    chmod 600 ~/.ssh/authorized_keys
    ```

1. Disconnect from the VM by running `exit`.
1. [Restart the VM](../operations/vm-control/vm-stop-and-start.md#restart).
1. Check the connection for the new user:

   ```bash
   ssh testuser@<VM_public_IP_address>
   ```

   Where `<VM_public_IP_address>` is the VM's [public IP address](../../vpc/concepts/address.md#public-addresses) for internet access.

   You can learn the public IP address of a VM from the **Public IPv4 address** field of the network interface under **Network** on the VM page in the [management console](https://console.yandex.cloud) or by using the `yc compute instance get <VM_name>` [YC CLI](../../cli/quickstart.md) command.

#### What's next {#what-is-next}

* [Using Yandex Cloud from within a VM](../operations/vm-connect/auth-inside-vm.md)

#### Useful links {#see-also}

* [Connecting to a Linux VM over SSH using Yandex Cloud Shell](../operations/vm-connect/cloud-shell.md)
* [Connecting to a Windows VM via RDP](../operations/vm-connect/rdp.md)
* [Connecting to a Windows VM via PowerShell](../operations/vm-connect/powershell.md)
* [Connecting to a VM via OS Login](../operations/vm-connect/os-login.md)

## Configure the serial console {#serial-console}

A [serial console](../concepts/serial-console.md), enables accessing a VM regardless of the [network](../../vpc/concepts/network.md#network) or OS state, when experiencing boot or SSH access issues.

Make sure you configure access to the VM via the serial console in advance.

## Delete the VM {#delete-vm}

If you no longer plan to use the VM, [delete it](../operations/vm-control/vm-delete.md).

## What's next {#what-is-next}

* Check out [tutorials for creating web services in Yandex Cloud](../../tutorials/applied/index.md#web).
* Learn [how to use VMs](../operations/index.md).
* Learn [how to create a VM with a GPU](../operations/vm-create/create-vm-with-gpu.md).
* Read [answers to frequently asked questions](../qa/general.md).