---
title: "Connect to a VM over SSH"
description: "Find the SSH command of a TIR Virtual Machine in TIR and sign in as root with your key from a terminal, with fixes for the common connection errors."
content_type: "how-to"
product: "tir-vm"
platform: "TIR"
url: "/tir/tir-vm/how-to/connect-to-a-vm-over-ssh/"
topic: ["create-and-connect"]
---

# Connect to a VM over SSH

SSH gives you a shell on your TIR Virtual Machine (VM) as `root`, from a terminal on your computer.
It is the one way to work inside a VM.

## Before you begin

- A VM in the **Running** state.
- The private key that matches an SSH key attached to the VM. To attach another key, see [Manage SSH
  keys on a VM](/tir/tir-vm/how-to/manage-ssh-keys-on-a-vm/).
- A security group on the VM that allows port 22, where SSH listens, from your address. See [Attach
  security groups to a VM](/tir/tir-vm/how-to/attach-security-groups-to-a-vm/).

## Find the SSH command

Open the VM from **Manage VMs** by selecting its name. While the VM is **Running**, **SSH Command**
is under **Connection Details** on the **Overview** tab. The **SSH** button at the top of the VM's
page gives the same command, a version with a key file, and a few commands to try once you are in.

## Connect from a terminal

1. Copy **SSH Command**. It has this form, with the VM's address in place of `<ip-address>`:

   ```bash
   ssh root@<ip-address>
   ```

   The address is the first one the VM has in this order: its public IP, its first reserved IP, its
   first VPC IP.

2. Paste the command into a terminal and run it. If your private key is in a file other than the one SSH tries
   by default, name it with `-i`:

   ```bash
   ssh -i ~/.ssh/<private-key-file> root@<ip-address>
   ```

   Replace `<private-key-file>` with the name of the private key that matches a key attached to the
   VM.

3. The first time you connect to an address, SSH asks you to accept the VM's fingerprint. Type `yes`.

You now have a prompt on the VM, and every command you type runs there as `root`. On a GPU plan, run
`nvidia-smi` to see the VM's GPUs.

**Running** means the VM's operating system is up. If the connection is refused right after that, give
SSH a moment to start and run the command again.

## If the connection fails

| What you see                                   | What to do                                                                                                                                                                                               |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `Connection refused` or `Connection timed out` | Check that an attached security group allows TCP port 22 from your address. See [Connection timed out](/tir/tir-vm/troubleshooting/tir-vm/#ssh-connect-to-host-ip-address-port-22-connection-timed-out). |
| `Permission denied (publickey)`                | Sign in as `root`, with the private key of a key attached to the VM. See [Permission denied](/tir/tir-vm/troubleshooting/tir-vm/#permission-denied-publickey).                                           |
| `WARNING: UNPROTECTED PRIVATE KEY FILE!`       | Run `chmod 400 ~/.ssh/<private-key-file>`, then connect again.                                                                                                                                           |
| `Host key verification failed`                 | A different VM now answers at an address you used before. Run `ssh-keygen -R <ip-address>`, then connect again.                                                                                          |
| **SSH Access** shows **Disabled**              | It turns on once the VM has an SSH key. Attach one. See [Manage SSH keys on a VM](/tir/tir-vm/how-to/manage-ssh-keys-on-a-vm/).                                                                          |

For other messages, see [Troubleshooting TIR Virtual Machines](/tir/tir-vm/troubleshooting/tir-vm/).

With a shell open, [add startup scripts to the VM](/tir/tir-vm/how-to/add-startup-scripts-to-a-vm/)
so it sets itself up again on every boot. To keep the same address across a stop and a start,
[attach a reserved IP to the VM](/tir/tir-vm/how-to/attach-a-reserved-ip-to-a-vm/).