---
title: "Manage SSH keys on a VM"
description: "Add, replace, or remove SSH keys on a TIR Virtual Machine from its Network & Security tab, while the VM keeps running."
content_type: "how-to"
product: "tir-vm"
platform: "TIR"
url: "/tir/tir-vm/how-to/manage-ssh-keys-on-a-vm/"
topic: ["create-and-connect"]
---

# Manage SSH keys on a VM

Add, replace, or remove the SSH keys that can sign in to a TIR Virtual Machine (VM), for example
when a colleague joins the project or a key is lost. The VM keeps running: it picks up a key change
within about 15 seconds.

## Before you begin

- A VM that is **Running** or **Stopped**.
- Permission to update VMs in the project. See [TIR
  Access Control](/tir/tir-iam/).
- A security group attached to the VM that allows port 22. If the VM lacks one, TIR asks you to attach
  one as you add the key. See [Attach security groups to a
  VM](/tir/tir-vm/how-to/attach-security-groups-to-a-vm/).
- For a new key, its public key. You can save it in your account's SSH keys from this tab, or
  beforehand. See [Add an SSH key](/tir/ssh-keys/how-to/add-an-ssh-key/).

## Open the SSH tab

In **Manage VMs**, select the VM's name, go to **Network & Security**, and select the **SSH** side
tab. The **SSH** switch is on while the VM has a key, and the attached keys are listed below it.

## Add a key

1. If the **SSH** switch is off, turn it on.
2. Select one or more of your saved keys. To use a new key,
   select the **Click here** link, enter a label and the public key in the **Add SSH Key** drawer, and
   save it. The new key is then picked for you.
3. Select **Update**.
4. In **Enable SSH Access**, select **Continue**.

The key is attached, and you can sign in with it once the VM picks it up, within about 15 seconds. See [Connect to a VM over
SSH](/tir/tir-vm/how-to/connect-to-a-vm-over-ssh/).

If the VM still needs a security group that allows port 22, **Update** first asks for one: choose a group in
**Select Security Group** and select **Attach**, then carry on with step 4.

## Replace a key

To replace a key, for example after you lose its private key, add the new key first, check that you
can sign in with it, then remove the old one. Both keys work until you remove the old one, so you
can sign in throughout.

## Remove a key

Select the remove button on the key's row, then **Remove** in **Remove Access**. Removing the last
key also turns off SSH access to the VM, so add another key first if you still want to sign in.

TIR removes the keys it added to the VM. A key you
added by hand inside the VM stays until you remove it there too.

For help with any message on this tab, see [Troubleshooting TIR Virtual
Machines](/tir/tir-vm/troubleshooting/tir-vm/#ssh-keys-can-only-be-updated-when-the-node-is-in-a-running-or-stopped-state-please-try-again-later). To limit which addresses can reach port 22, [attach a security group of
your own](/tir/tir-vm/how-to/attach-security-groups-to-a-vm/).