I am running a Compute Engine VM in Google Cloud.

When I set up the instance, I pasted a public key into the Security section. Now that the instance is running, I can see that public key on its page in Google Cloud console (so it was saved and is associated)

However, I cannot ssh into the instance from my terminal. I opened Google's ssh client in the browser and saw that the ~/.ssh/authorized_keys file does not have my public key in it.

I manually edited ~/.ssh/authorized_keys to add a line with the same public key that is shown in the Google Cloud console on this instance, and found that I could connect from my terminal. But as soon as I terminate Google's in-browser ssh session, ~/.ssh/authorized_keys is reset and public ssh connections are blocked.

How do I allow public ssh connections to this instance?

  • What is the error-message? Are FW-rules (allow) in place?
    – ppuschmann
    Feb 22, 2021 at 7:48
  • @ppuschmann how do I check the forwarding rules? And the error message of external connection is Permission denied (publickey). Feb 22, 2021 at 11:02

1 Answer 1


Since you mention that ~/.ssh/authorized_keys file does not have your public key in it, this might be related to OS login activated at instance or project level.

Follow this guide to disable OS Login if enabled, as explained in the warning for this step:

Caution: Enabling OS Login on instances disables metadata-based SSH key configurations on those instances. Disabling OS Login restores SSH keys that you have configured in project or instance metadata.

If this is not the problem, you should collect and share your logs:

  1. Go to Compute Engine -> VM instances -> click on NAME_OF_YOUR_VM -> at the VM instance details find section Logs and click on Serial port 1 (console)

  2. Reboot your VM instance (if possible).

  3. Check full boot log for any errors or/and warnings.

  4. If you found errors/warning related to disk space you can try to resize it accordingly to the documentation Resizing a zonal persistent disk or follow this article Recovering an inaccessible instance or a full boot disk.

  5. If you require more help, share the full log by using pastebin.com.

  • Your link doesn't point out how to check if OS Login is enabled Feb 22, 2021 at 20:35
  • It looks like following option 1 here (but replacing TRUE with FALSE) may have fixed it Feb 22, 2021 at 20:46
  • I linked to that guide because it is the step to enable or disable OS Login, based on that, you just had to disable it if it was enabled, just like you did by replacing TRUE with FALSE, my answer was edited to have a better description of that step. Remember to upvote or accept the answer if it was helpful.
    – Lalo P
    Feb 22, 2021 at 21:20
  • Is the full log from Serial port 1 safe to share? Mar 15, 2021 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.