[Yandex Cloud documentation](../../index.md) > [Yandex Data Processing](../index.md) > [Step-by-step guides](index.md) > Yandex Data Processing clusters > Connection > Connecting to a host via OS Login

# Connecting to a Yandex Data Processing host via OS Login 

{% note warning %}

You can enable OS Login access to hosts only when [creating a cluster](cluster-create.md).

{% endnote %}

[OS Login](../../organization/concepts/os-login.md) is used instead of SSH keys to access Yandex Cloud virtual machines.

You can connect to Yandex Data Processing cluster hosts via OS Login using a [standard SSH client](connect-oslogin.md#os-login-ssh) or the [Yandex Cloud CLI](connect-oslogin.md#os-login-cli).

Before connecting:

1. [Enable access via OS Login](../../organization/operations/os-login-access.md) at the organization level.
1. [Configure security groups](security-groups.md).
1. Assign the required roles to the user or [service account](../../iam/concepts/users/service-accounts.md) you will use for the connection:
    
   * `compute.osLogin` or `compute.osAdminLogin` [role](../../compute/security/index.md#compute-oslogin).
   * `resource-manager.auditor` [role](../../resource-manager/security/index.md#resource-manager-auditor) or higher for the folder housing the VM.
   * `compute.operator` [role](../../compute/security/index.md#compute-operator) for connecting via the Yandex Cloud CLI.

1. If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

## Connecting using a standard SSH client {#os-login-ssh}

1. [Export the OS Login certificate](../../compute/operations/vm-connect/os-login-export-certificate.md).

   {% note info %}

   The certificate is valid for one hour, after which you need to export it again.

   {% endnote %}

   The certificate includes the public and private parts. Save the path to the `Identity` private part, as you will need it to connect to the host.

1. Get the Yandex Data Processing host IP address:

    1. Get a list of hosts:

       ```bash
       yc dataproc cluster list-hosts <cluster_name_or_ID>
       ```

       You can get the cluster ID and name with the [list of clusters](cluster-list.md#list) in the folder.

       Result:

       ```bash
       +------------------------------------------------------+----------------------+------------+----------------------+--------+
       |                         NAME                         | COMPUTE INSTANCE ID  |    ROLE    |    SUBCLUSTER ID     | HEALTH |
       +------------------------------------------------------+----------------------+------------+----------------------+--------+
       | rc1a-dataproc-d-q8659net********.mdb.yandexcloud.net | fhmr7sd33fl8******** | DATANODE   | c9qaps7qjj2d******** | ALIVE  |
       | rc1a-dataproc-m-hhhifdgl********.mdb.yandexcloud.net | fhmg686pspri******** | MASTERNODE | c9q7aen26lid******** | ALIVE  |
       +------------------------------------------------------+----------------------+------------+----------------------+--------+
       ```

       From the `COMPUTE INSTANCE ID` column, save the VM ID that matches your host.

   1. Get the VM info:

      ```bash
      yc compute instance get <VM_ID>
      ```

      Result:

      ```yml
      ...
      primary_v4_address:
        address: <internal_IP_address>
        one_to_one_nat:
          address: <external_IP_address>
          ip_version: IPV4
      ...
      ```

      If you are connecting to the host from the internet, save the external IP address; for connections from an jump host VM, save the internal IP address.

1. Connect to the host:

    ```bash
    ssh -i <path_to_certificate_file> <user_login>@<host_IP_address>
    ```

    Where:

    * `<path_to_certificate_file>`: Path to the certificate's `Identity` file you saved earlier, e.g., `/home/user1/.ssh/yc-cloud-id-b1gia87mbaom********-orgusername`.
    * `<user_login>`: User login as set in their [OS Login profile](../../organization/concepts/os-login.md#os-login-profiles). This login is also specified at the end of the name of the exported OS Login certificate. In the example above, it is `orgusername`.

        {% note info %}

        For service accounts, [OS Login profiles](../../organization/concepts/os-login.md#os-login-profiles) are not created automatically. To connect to a VM or Kubernetes node on behalf of a service account, you need to [manually create](../../organization/operations/os-login-profile-create.md) an OS Login profile.

        {% endnote %}

    * `<host_IP_address>`: Host IP address you got earlier.

    If this is your first time connecting to the host, you will get an unknown host warning:

    ```text
    The authenticity of host '158.160.**.** (158.160.**.**)' can't be established.
    ECDSA key fingerprint is SHA256:PoaSwqxRc8g6iOXtiH7ayGHpSN0MXwUfWHk********.
    Are you sure you want to continue connecting (yes/no)?
    ```

    Type `yes` into the terminal and press **Enter**.  

## Connecting using the CLI {#os-login-cli}

1. Get the list of Yandex Data Processing hosts:

   ```bash
   yc dataproc cluster list-hosts <cluster_name_or_ID>
   ```

   You can get the cluster ID and name with the [list of clusters](cluster-list.md#list) in the folder.

   Result:

   ```bash
   +------------------------------------------------------+----------------------+------------+----------------------+--------+
   |                         NAME                         | COMPUTE INSTANCE ID  |    ROLE    |    SUBCLUSTER ID     | HEALTH |
   +------------------------------------------------------+----------------------+------------+----------------------+--------+
   | rc1a-dataproc-d-q8659net********.mdb.yandexcloud.net | fhmr7sd33fl8******** | DATANODE   | c9qaps7qjj2d******** | ALIVE  |
   | rc1a-dataproc-m-hhhifdgl********.mdb.yandexcloud.net | fhmg686pspri******** | MASTERNODE | c9q7aen26lid******** | ALIVE  |
   +------------------------------------------------------+----------------------+------------+----------------------+--------+
   ```

   From the `COMPUTE INSTANCE ID` column, save the VM ID that matches your host.

1. Connect to the host:

    ```bash
    yc compute ssh --id <VM_ID>
    ```

    {% note info %}

    For service accounts, [OS Login profiles](../../organization/concepts/os-login.md#os-login-profiles) are not created automatically. To connect to a VM or Kubernetes node on behalf of a service account, you need to [manually create](../../organization/operations/os-login-profile-create.md) an OS Login profile.

    {% endnote %}