Adding instance-level public SSH keys to GCE instance

Question

Per Managing SSH keys in Metadata  |  Compute Engine Documentation  |  Google Cloud, I edited instance-level public SSH key metadata by adding my public key (in following format):

ssh-rsa [KEY_VALUE] [USERNAME]

yet cannot connect.

/var/log/auth.log:

Apr 18 15:24:19 web0 sshd[5080]: Invalid user staging from X.X.X.X port 52403
Apr 18 15:24:19 web0 sshd[5080]: input_userauth_request: invalid user XXX [preauth]
Apr 18 15:24:19 web0 sshd[5080]: error: Received disconnect from X.X.X.X port 52403:14: No supported authentication methods available [preauth]
Apr 18 15:24:19 web0 sshd[5080]: Disconnected from X.X.X.X port 52403 [preauth]

Please advise.

Answer 1

When you create your private/public key pair using a command such as the below:

ssh-keygen -t rsa -C "[email protected]"

Your email address should already be present in the generated public key file (generally named id_rsa.pub by default).

You should therefore only need to copy the contents of this file and paste it straight into the instance ssh-keys section in the Console. So yes, the format you've written is correct, but the most reliable way to ensure you are inputting it correctly is to copy it straight from the public key file.

One method to validate you have entered the public key into the instance SSH keys section is to check your username appears to the left of the box you are pasting the public key into, as displayed in your linked article.

If it doesn't appear, this may be a clue that the key format is wrong. If this is the case, one thing I would suggest is checking there are no new lines in the pasted key. You should be able to place the cursor at the start of the pasted key in the box and press the right arrow key from start to finish. If there are any new lines remove them so that the key is continuous.

If none of the above is relevant some additional information would be useful. From where are you trying to connect? Also, what command are you using to connect to the instance?

EDIT:

As the user from the SSH key isn't appearing in the /etc/passwd file, this suggests that it may be possible that relevant services of the Linux Guest Environment are not running, which in turn means that metadata is not propagating to the instance. I believe the Compute Engine Accounts Daemon within the Linux Guest Environment may be responsible for this issue.

You can try running the following command to see if it is active:

sudo systemctl list-units --all | grep google 

If it is not active/installed there is some useful information here about how to start the services, or install the Linux Guest Environment if it is not already installed on the instance.