[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > [Step-by-step guides](index.md) > Authentication > Working with OS Login > Enabling access via OS Login

# Enabling access via OS Login

{% note info %}

If OS Login access is [enabled](os-login-access.md) at the organization level, all new VMs created in this organization will get the `OS_LOGIN` value in the `serial_port_settings.ssh_authorization` field by default. If OS Login access is disabled in the organization, the default value of this field will be `INSTANCE_METADATA`.

{% endnote %}

With [OS Login](../concepts/os-login.md), you can manage SSH access to [VMs](../../compute/concepts/vm.md#project) and [individual nodes in node groups](../../managed-kubernetes/concepts/index.md#node-group) within [Yandex Managed Service for Kubernetes clusters](../../managed-kubernetes/concepts/index.md#kubernetes-cluster) relying solely on the [Yandex Identity and Access Management](../../iam/concepts/index.md) mechanisms. There is no need to upload SSH keys to each new VM or Kubernetes node when one is created. OS Login links the VM or Kubernetes node user account to a Yandex Identity Hub account, i.e., an [organization user](../concepts/membership.md) account or [service account](../../iam/concepts/users/service-accounts.md).

{% note alert %}

A user with [superuser](https://en.wikipedia.org/wiki/Superuser) permissions for a VM can retain access to it even if the [roles are revoked](../security/index.md#revoke). To prevent user access to a VM with old permissions, [create](../../compute/operations/images-with-pre-installed-software/create.md) a new VM from a clean image.

{% endnote %}

To create virtual machines or Kubernetes nodes with OS Login access, enable this feature at the organization level. To do this:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.

      [Switch](manage-organizations.md#switch-to-another-org) to an organization or federation of your choice as needed.

  1. In the left-hand panel, select ![shield](../../_assets/console-icons/shield.svg) **Security settings**.

  1. Enable the required operating modes:

      * **Access via OS Login using SSH certificates (recommended)**.
          This mode allows you to connect to a VM or Kubernetes cluster node with an SSH certificate [through the Yandex Cloud CLI](../../compute/operations/vm-connect/os-login.md#connect-with-yc-cli) or a [standard SSH client](../../compute/operations/vm-connect/os-login.md#connect-with-ssh-client).

      * **Access via OS Login using SSH keys**.
          This mode allows you to connect to a VM or Kubernetes cluster node through the Yandex Cloud CLI or a standard SSH client using an SSH key stored in the [OS Login profile](../concepts/os-login.md#os-login-profiles) of a user or [service account](../../iam/concepts/users/service-accounts.md).

      * **Allow members to use their own SSH keys**.
          Allows users themselves to upload public SSH keys to their OS Login profiles for connection to VMs or Kubernetes cluster nodes.

          You can add a new SSH key to your profile in the management console when creating a VM or by following the guide titled [Adding an SSH key](add-ssh.md).

          Only [Yandex account](../../iam/concepts/users/accounts.md#passport), [federated](../../iam/concepts/users/accounts.md#saml-federation) or [local](../../iam/concepts/users/accounts.md#local) users assigned the `organization-manager.osLogins.admin` [role](../security/index.md#organization-manager-osLogins-admin) or higher can upload SSH keys to service account [OS Login profiles](../concepts/os-login.md#os-login-profiles).

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View the description of the CLI command to enable OS Login access at the organization level:

      ```bash
      yc organization-manager oslogin update-settings --help
      ```

  1. Get the ID of the required organization:

      ```bash
      yc organization-manager organization list
      ```

      Result:

      ```text
      +----------------------+-------------------------+-------------------------+
      |          ID          |          NAME           |          TITLE          |
      +----------------------+-------------------------+-------------------------+
      | bpf1smsil5q0******** | sample-organization-1   | My organization         |
      | bpf2c65rqcl8******** | sample-organization-new | New organization        |
      +----------------------+-------------------------+-------------------------+
      ```

  1. Enable access via OS Login for the selected organization:

      ```bash
      yc organization-manager oslogin update-settings \
        --organization-id <organization_ID> \
        --ssh-certificates-enabled \
        --ssh-user-keys-enabled \
        --allow-manage-own-keys
      ```

      Where:

      * `--organization-id`: Organization ID you got earlier.
      * `--ssh-certificates-enabled`: OS Login access using SSH certificates. This option allows you to connect to VMs or Kubernetes cluster nodes with an SSH certificate [through the Yandex Cloud CLI](../../compute/operations/vm-connect/os-login.md#connect-with-yc-cli) or a [standard SSH client](../../compute/operations/vm-connect/os-login.md#connect-with-ssh-client).

          To disable this option, provide the `false` value in the `--ssh-certificates-enabled=false` parameter.

      * `--ssh-user-keys-enabled`: OS Login access using SSH keys. This option allows you to connect to VMs or Kubernetes cluster nodes via the Yandex Cloud CLI or a standard SSH client, using an SSH key stored in the OS Login profile of an organization user or service account.

          To disable this option, provide the `false` value in the `--ssh-user-keys-enabled=false` parameter.

      * `--allow-manage-own-keys`: Allow users to upload their own SSH keys. This option allows users themselves to upload public SSH keys to their OS Login profiles for connection to VMs and Kubernetes cluster nodes. To upload your own SSH keys, follow [this guide](add-ssh.md).

          To disable this option, provide the `false` value in the `--allow-manage-own-keys=false` parameter.

          {% note info %}

          Only [Yandex account](../../iam/concepts/users/accounts.md#passport), [federated](../../iam/concepts/users/accounts.md#saml-federation) or [local](../../iam/concepts/users/accounts.md#local) users assigned the `organization-manager.osLogins.admin` [role](../security/index.md#organization-manager-osLogins-admin) or higher can upload SSH keys to service account [OS Login profiles](../concepts/os-login.md#os-login-profiles).

          {% endnote %}

      Result:

      ```text
      user_ssh_key_settings:
        enabled: true
        allow_manage_own_keys: true
      ssh_certificate_settings:
        enabled: true
      ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. In the configuration file, describe the properties of resources you want to create:

      ```hcl
      resource "yandex_organizationmanager_os_login_settings" "my_os_login_settings" {
        organization_id = "<organization_ID>"
        ssh_certificate_settings {
          enabled = true
        }
        user_ssh_key_settings {
          enabled               = true
          allow_manage_own_keys = true
        }
      }
      ```

      Where:

      * `organization_id`: Organization ID. You can get the organization ID using the `yc organization-manager organization list` command in the [Yandex Cloud CLI](../../cli/quickstart.md) or through the [Cloud Center interface](https://center.yandex.cloud).

      * `ssh_certificate_settings`: OS Login access using SSH certificates. This option allows you to connect to VMs or Kubernetes cluster nodes with an SSH certificate [through the Yandex Cloud CLI](../../compute/operations/vm-connect/os-login.md#connect-with-yc-cli) or a [standard SSH client](../../compute/operations/vm-connect/os-login.md#connect-with-ssh-client). The `enabled` parameter may take either the `true` (option enabled) or `false` (option disabled) values.

      * `user_ssh_key_settings`: Section for managing access through user SSH keys.

          * `enabled`: OS Login access using SSH keys. This option allows you to connect to VMs or Kubernetes cluster nodes via the Yandex Cloud CLI or an SSH key stored in the profile of an organization user. It may take either the `true` (option enabled) or `false` (option disabled) values.

          * `allow_manage_own_keys`: Allow users to upload their own SSH keys. This option allows users themselves to upload public SSH keys to their OS Login profiles for connection to VMs and Kubernetes cluster nodes. To upload your own SSH keys, follow [this guide](add-ssh.md). It may take either the `true` (option enabled) or `false` (option disabled) values.

          {% note info %}

          Only [Yandex account](../../iam/concepts/users/accounts.md#passport), [federated](../../iam/concepts/users/accounts.md#saml-federation) or [local](../../iam/concepts/users/accounts.md#local) users assigned the `organization-manager.osLogins.admin` [role](../security/index.md#organization-manager-osLogins-admin) or higher can upload SSH keys to service account [OS Login profiles](../concepts/os-login.md#os-login-profiles).

          {% endnote %}

      For more information about the resources you can create with Terraform, see the [relevant provider documentation](../../terraform/resources/organizationmanager_os_login_settings.md).

  1. Make sure the configuration files are correct.

      1. In the command line, navigate to the directory where you created the configuration file.
      1. Run a check using this command:

          ```bash
          terraform plan
          ```

      If the configuration description is correct, the terminal will display a list of the resources being created and their settings. If the configuration contains any errors, Terraform will point them out.

  1. Deploy the cloud resources.

      1. If the configuration does not contain any errors, run this command:

          ```bash
          terraform apply
          ```

      1. Confirm creating the resources.

      The organization settings will then be changed. To make sure OS Login access is enabled, run this Yandex Cloud CLI command by specifying the organization ID:

      ```bash
      yc organization-manager oslogin get-settings --organization-id <organization_ID>
      ```

      Result:

      ```text
      user_ssh_key_settings:
        enabled: true
        allow_manage_own_keys: true
      ssh_certificate_settings:
        enabled: true
      ```

- API {#api}

  Use the [updateSettings](../api-ref/OsLogin/updateSettings.md) REST API method for the [OsLogin](../api-ref/OsLogin/index.md) resource or the [OsLoginService/UpdateSettings](../api-ref/grpc/OsLogin/updateSettings.md) gRPC API call.

{% endlist %}

{% note info %}

The minimum required role allowing you to view the list of OS Login user profiles is the `organization-manager.osLogins.viewer` [role](../security/index.md#organization-manager-osLogins-viewer) assigned for your organization. For information about other roles allowing you to view the list of OS Login profiles, see [Access management in Yandex Identity Hub](../security/index.md#service-roles).

{% endnote %}

#### See also {#see-also}

* [Creating an OS Login profile](os-login-profile-create.md)
* [Adding an SSH key](add-ssh.md)
* [Connecting to a VM via OS Login](../../compute/operations/vm-connect/os-login.md)
* [Connecting to a Kubernetes node via OS Login](../../managed-kubernetes/operations/node-connect-oslogin.md)
* [Using a service account with an OS Login profile for VM management via Ansible](../tutorials/sa-oslogin-ansible.md)