Connect to a virtual machine
Sign in to a virtual machine over SSH, open its console in your browser, or download its serial console log when the network is unreachable.
Sign in to an instance over the network with SSH, or reach it through the platform with the browser console and the serial console log. The browser console and the serial log don't depend on the instance's network.
Before you begin
- To use SSH or the browser console, the instance must be Running.
- To use SSH from the internet, the instance needs a public address, such as a Floating IP, and a security group rule that allows inbound TCP port 22 from your address. You can add both in the creation wizard. See Create a virtual machine.
- You need the private key of a key pair that the instance was created with, or the administrator username and password that you set when you created it.
- To open the browser console, you need the Owner or Contributor role, or a custom role with Manage access to Compute / Instances. To download the serial console log, any role with Read access to Compute / Instances is enough.
Connect with SSH
In the console, go to ComputeInstances, and select the instance.
Select Connect. The Connect tab opens.
Copy the command from the SSH panel, and run it in a terminal on your computer.
The command has this form:
ssh -i ~/.ssh/<key-name>.pem <user>@<address><key-name>: the first key pair that the instance was created with. Any of the instance's key pairs works.<user>: the user to sign in as. The Connect tab shows the suggested user for the image when it recognizes the image's operating system, as in the following table. Otherwise, the command shows<user>, and you need to look up the user in the image's documentation.<address>: the instance's Floating IP when it has one, otherwise its private IP address. You can reach a private address only from a network that's connected to the instance's network, for example over Site-to-Site VPN.
| Operating system in the image | User that the console suggests |
|---|---|
| Ubuntu | ubuntu |
| Debian | debian |
| Fedora | fedora |
| CentOS | centos |
| Rocky Linux | rocky |
| AlmaLinux | almalinux |
| CirrOS | cirros |
The tab also shows an entry for your SSH configuration file. Add it to ~/.ssh/config to connect with ssh <instance-name>:
Host <instance-name>
HostName <address>
User <user>
IdentityFile ~/.ssh/<key-name>.pemSign in with the administrator password
If you turned on Set an admin password when you created the instance, the account was set up on the first boot with sudo access, and SSH password login is turned on. Sign in with that account's name and enter the password when you're asked:
ssh <username>@<address>Instances with a Windows image
If the console recognizes the image as Windows, the Connect tab shows an RDP panel instead of the SSH panel, with the instance's address on port 3389 and an mstsc command for the Administrator account. To allow RDP, add a security group rule for inbound TCP port 3389, such as the Remote desktop (RDP) quick rule.
Open the browser console
The browser console shows the instance's screen and accepts keyboard input. It works even when the instance has no network connectivity.
On the instance page, select Console. The console opens in a new browser tab and connects.
Select the console screen, and work in it as on a local display.
You can also open the console from the Connect tab with Open console, or from the instance list with Open console.
The console page offers these controls:
- Ctrl-Alt-Del: sends Ctrl+Alt+Del to the guest. The console asks you to confirm first, because on most guests it reboots the machine immediately.
- Send key: sends other key combinations to the guest.
- Paste: types the text in the box into the guest as keystrokes. It works in one direction only, from your browser to the guest. The guest console uses a US keyboard layout, so characters without a key on that layout, such as Turkish letters or the euro sign, can't be sent.
- Fullscreen and Reconnect.
Each connection uses a single-use ticket that expires 60 seconds after it's issued. If the connection drops, select Reconnect to get a new ticket. The console token itself never reaches your browser.
Download the serial console log
The serial console log contains the output of the instance's first serial port (ttyS0), such as boot messages. Use it to see whether the guest booted and brought up its network, for example when the instance isn't reachable over SSH.
On the instance page, select the Connect tab.
Under Serial console log, select Download serial log.
The browser saves a text file whose name ends in -ttyS0.log. It contains up to the last 1,000 lines of output. The file is empty when there's no output to show, for example when the instance's creation failed before it reached the cloud. If the download fails, the console shows Couldn't export the serial console log.
You can also download the log from the console page's Serial log tab.
Troubleshooting
- If the browser console doesn't open, see The browser console doesn't open.
- If SSH times out or is refused, check that the instance has a Floating IP and that a security group allows inbound TCP port 22 from your address. See You can't connect over SSH.