Manage SSH keys on a VM

Add, replace, or remove the SSH keys that can sign in to a TIR Virtual Machine (VM), for example when a colleague joins the project or a key is lost. The VM keeps running: it picks up a key change within about 15 seconds.

Before you begin

• A VM that is Running or Stopped.
• Permission to update VMs in the project. See TIR Access Control.
• A security group attached to the VM that allows port 22. If the VM lacks one, TIR asks you to attach one as you add the key. See Attach security groups to a VM.
• For a new key, its public key. You can save it in your account’s SSH keys from this tab, or beforehand. See Add an SSH key.

Open the SSH tab

In Manage VMs, select the VM’s name, go to Network & Security, and select the SSH side tab. The SSH switch is on while the VM has a key, and the attached keys are listed below it.

Add a key

1. If the SSH switch is off, turn it on.
2. Select one or more of your saved keys. To use a new key, select the Click here link, enter a label and the public key in the Add SSH Key drawer, and save it. The new key is then picked for you.
3. Select Update.
4. In Enable SSH Access, select Continue.

The key is attached, and you can sign in with it once the VM picks it up, within about 15 seconds. See Connect to a VM over SSH.

If the VM still needs a security group that allows port 22, Update first asks for one: choose a group in Select Security Group and select Attach, then carry on with step 4.

Replace a key

To replace a key, for example after you lose its private key, add the new key first, check that you can sign in with it, then remove the old one. Both keys work until you remove the old one, so you can sign in throughout.

Remove a key

Select the remove button on the key’s row, then Remove in Remove Access. Removing the last key also turns off SSH access to the VM, so add another key first if you still want to sign in.

TIR removes the keys it added to the VM. A key you added by hand inside the VM stays until you remove it there too.

For help with any message on this tab, see Troubleshooting TIR Virtual Machines. To limit which addresses can reach port 22, attach a security group of your own.