---
title: "Manage SSH keys and Security Groups"
description: "Choose the SSH keys and the Security Group of a TIR Auto Scaling Group, change them on a running group, and sign in to a VM of the group."
content_type: "how-to"
product: "tir-auto-scaling"
platform: "TIR"
url: "/tir/tir-auto-scaling/how-to/manage-ssh-keys-and-security-groups/"
topic: ["network"]
---

# Manage SSH keys and Security Groups

SSH keys decide who can sign in to the VMs of an Auto Scaling Group. The Security Group decides which
traffic can reach them. Every VM of the group shares one set of SSH keys and one list of Security Groups.

## Before you begin

- An SSH key in your account. To make one, see [SSH Key Management](/tir/ssh-keys/).
- A Security Group in the same project and region as the group, with an inbound rule for port 22. To
  make one, see [Create a security group](/tir/tir-security-group/how-to/create-a-security-group/).
- Permission to update VMs in the project, which covers attaching and detaching keys and Security
  Groups. See [TIR Access Control](/tir/tir-iam/).

## Choose keys and a Security Group when you create a group

A group needs at least one SSH key and a Security Group that opens port 22. Both are under
**Network & Security** on the create form.

1. Under **SSH Keys**, pick one key or several. If the key you need is missing, select **Click
   here** to add it; a key you add there is picked for you.
2. Under **Security Group**, pick a group that opens port 22. Once you have picked a key, you can
   choose only a group that opens port 22. If the current group blocks SSH, TIR switches to the
   default SSH Security Group.
3. Check the inbound rules of the group you chose.

The default Security Group allows SSH on port 22 from every address (0.0.0.0/0), and its rules
are fixed. For stricter control, make your own Security Group that opens
port 22 only to the addresses you trust.

Every VM of the group starts with the keys you picked, and the one Security Group covers every VM the
group launches.

## Public IP addresses

Every VM gets its own public IP address once it is ready, and its own private IP address. For one
address that serves the whole group, [connect a load
balancer](/tir/tir-auto-scaling/how-to/connect-a-load-balancer/).

A public IP address is released when the VM is removed. The public address always opens port 22 for SSH, and it also opens the
inbound port numbers of every attached Security Group. Only TCP traffic reaches a VM's public address.

## Change the SSH keys of a running group

1. In **Auto Scaling Groups**, select the group's name, go to **Network & Security**, and select the
   **SSH** side tab.
2. Under **Search label**, pick the keys to attach.
3. Select **Update**. The keys reach every VM in the group.

To remove a key, select **Detach** on its row and confirm. The key stops working on every VM in the
group, including running ones, and anyone connected with that key is locked out the next time they connect.

You can change keys only while the group is **Running** or **Stopped**. A group with no Security
Group cannot take a key yet, so first select **Attach a security group** and follow the next
section. SSH works only when a Security Group allows inbound TCP traffic on port 22. When the attached Security Groups keep port 22
closed, the tab warns you; attach a group that opens port 22.

## Change the Security Groups of a running group

1. On the details page, go to **Network & Security** and select the **Security Groups** side tab. To
   make a new group first, select **Click here**.
2. Pick the groups to attach, up to 5 at a time.
3. Select **Attach**.

To detach a group, select its row's detach button, tick "Are you sure you want to detach this
security group?", and select **Detach**. Detaching can affect the resources and network settings
that rely on the group. While the group has SSH keys, it must keep at least one Security Group, so
attach another before you detach the last one.

## Sign in to a VM of the group

On the **Overview** tab, **Connect** has `ssh root@<public IP>` for up to three VMs, and
**VMs & Monitoring** has the public IP address of every VM. Run the command in a terminal on your
computer with the private key that matches an attached SSH key. A stopped group has no VMs to
connect to.

## Check the keys and groups

The attached key shows **Attached** on the **SSH** tab, and the attached Security Group shows
**Attached** on the **Security Groups** tab. A command from **Connect** then opens a shell on
the VM.

To watch the VMs and their addresses, see [Monitor an Auto Scaling Group](/tir/tir-auto-scaling/how-to/monitor-an-auto-scaling-group/).
To make a new group, see [Create an Auto Scaling Group](/tir/tir-auto-scaling/how-to/create-an-auto-scaling-group/).
For help with a refused change, see [Troubleshooting TIR Auto Scaling Groups](/tir/tir-auto-scaling/troubleshooting/tir-auto-scaling/).