---
title: "Connect via SSH"
description: >-
  How to SSH into your TIR Virtual Machine, manage SSH keys, and configure port forwarding for web applications.
---

# Connect via SSH

TIR Virtual Machines are accessible over SSH using the IP address assigned to your VM. This guide covers initial connection, key management, and common access patterns.

## Prerequisites

Before connecting, verify:

- VM status is **Running** (visible on the VM Details page)
- A **Security Group with port 22 open** is attached to the VM
- You have the **private key (.pem)** corresponding to the SSH key attached at launch

---

## 1. Find Your VM's IP Address

1. Navigate to **Virtual Machines** in the TIR portal.
2. Click your VM name to open the **VM Details** page.
3. Copy the **IP Address** shown under the Connection section.


---

## 2. Connect via SSH

Open your terminal and run:

```bash
ssh root@<VM_IP_ADDRESS>
```

**Example:**

```bash
ssh root@203.0.113.42
```


:::info
The default username for all TIR VM images is **`root`**. Password-based login is disabled — only SSH key authentication is accepted.
:::

---

## 3. Add or Rotate SSH Keys

TIR VMs run an **SSH sync agent** that watches for key updates and applies them live, without restarting the VM. This means you can add, remove, or rotate SSH keys at any time.

### Add a New SSH Key

1. In the TIR portal, navigate to your VM's **Details** page.
2. Click the **Network & Security Tab** tab.
3. Click on **Configure SSH** then select existing key from your account or upload a new public key.
4. Click **Update**.

---


## Troubleshooting

| Problem | Likely Cause | Fix |
|---------|-------------|-----|
| `Connection refused` | Port 22 not open | Attach a Security Group with an inbound rule for port 22 |
| `Permission denied (publickey)` | Wrong key or username | Verify you are using `root` and the correct `.pem` file |
| `WARNING: UNPROTECTED PRIVATE KEY FILE` | Key file permissions too open | Run `chmod 400 <key.pem>` |
| `Host key verification failed` | IP reused after VM recreate | Run `ssh-keygen -R <VM_IP>` to clear the known hosts entry |
| VM shows Running but SSH hangs | VM still finishing first-boot setup | Wait 30–60 seconds after status changes to Running |


---