6

I created a Compute Engine VM (Ubuntu 18.04), and when I log into it using the SSH button in the VM instances list I'm logged in as user username.

After a while, I realised I needed to be able to use another SSH client as well. As per https://cloud.google.com/compute/docs/instances/connecting-advanced I enabled OS Login by adding a key-value pair in metadata, where key is enable-oslogin and value is TRUE.

I then tried to add my existing SSH key:

gcloud compute os-login ssh-keys add --key-file path/to/key.pub --ttl 0

which was successful except one major problem: it has added the key for user username_gmail_com and will only allow me to ssh to my VM as that user:

ssh username_gmail_com@myinstance

And it has also created that user on my VM. From the web interface, I'm logged in to the VM with that new user as well (/home/username_gmail_com). Of course, I can still access the original user's data (/home/username). When I disable OS Login the web interface logs me in as username again and SSH from another client is disabled.

  1. Why is the username different when enabling OS Login?
  2. Can I change the username with OS Login enabled?

Edit

There has been an addition to the docs explaining exactly this question. Check here: https://cloud.google.com/compute/docs/oslogin/ and on the page I mentioned above all the way at the bottom under "Expected login behaviors".

0

5 Answers 5

3

I asked this question here and got a clear answer.

Why is the username different between OS Login enabled and disabled?

OS Login ties your Linux user account to your Google identity so that you have a consistent username, UID, and other posix information, in every VM you log into.

[...]

In order to prevent uniqueness conflicts across different organizations (user@gmail.com and user@example.com) the domain name is included by default.

[...]

When OS Login is not enabled, the username is set in your SSH key which has no tie-in to a user's Google identity. The username is generated to be convenient, and none of the OS Login-specific concerns apply.

And can I influence the username when OS Login enabled?

The posix information is immutable for consumer identities (non-G Suite users).

So no, I can't, because I'm an individual and not an organisation.

In the end, I solved the inconveniece this caused me by simply recreating the server with OS Login enabled - that of course is one of the strengths of Compute Engine.

1
  • The "by default" wording makes it sound like it can be changed. They should just remove "by default" from the sentence.
    – Andy Shinn
    Oct 30, 2019 at 22:22
0

If you added your ssh-key inside meta-datas, you should be able to access root account inside the instance doing this command:

sudo -i

When in root you can access the /home/username folder and transfer files that you need.

5
  • Thanks for your answer. Of course I can sudo to transfer files between my 2 users, but that's way to inconvenient (especially when it's not me but, say, a fabfile). Instead, I should be able to ssh to my first user and the second one should never have existed in the first place. From my local console I login with the new username while the Google console (web interface) logs in with my initial username! I wish to correct that, so that I can login from my local console using my initial username. Nov 27, 2018 at 19:13
  • That's tricky... you could try to trick the google metadata by updating the user name at the end of your ssh-key using the first user name and see if you login inside the same user...
    – night-gold
    Nov 27, 2018 at 19:18
  • I'll give that a try. Meanwhile, Google has decided to login with the new username too - ??? it has something to do with OS Login set to TRUE. Why that switches to another username is a mystery to me. Nov 27, 2018 at 19:23
  • It didn't work, the keys in Compute -> Metadata -> Keys can't be edited. Please also see the edit in my question. Nov 27, 2018 at 19:33
  • You can't edit the key you must add a new one for this to work
    – night-gold
    Nov 27, 2018 at 20:06
0

As per this github document, the OS Login package (guest environment in the instance) fetches SSH keys from the user’s OS Login profile, and make them available to sshd. But doing so, it has to query the metadata server for the profile, and check for authorization of the user account (email address).

As to explain further, If using third-party tools to SSH, the traditional way to add users to the instance is by creating and adding public keys for each user to the instance's or project's metadata, and according to this document.

However, OS Login is designed to use Compute Engine IAM Roles as to manage SSH keys. That means that each user that needs to be granted SSH access to the instance should have a Google account (email), the account should be a member of the project, and has the proper Compute Engine IAM roles (e.g compute.oslogin).

Thus, when the process explained in the above github link happens for the first time, it creates a user that inherits the account’s format (email) like user_lastname_gmail_com. For further information about OS Login you may verify this document

3
  • 1
    Thanks for pointing me to the github repo. The other 2 docs I'd already read (over and over). None of these explain why the account format is used as user_gmail_com instead of just user. The fact that it does that isn't mentioned anywhere, nor how to influence the username used by OS Login, nor why that's done by OS Login but not when OS Login is disabled (with the same google account). Do you have any idea? Nov 28, 2018 at 10:19
  • @WilKoetsier When using OS Login you want to control users access through IAM, so you add each user to the project. You can not change usernames as they are being extracted from IAM. When OS Login is disabled, you can use any username you wish. For example, if using SSH from the browser, and even if you are logged in to the project with your account, you can “Change Linux Username” by clicking the top right setup icon in the window. More information about the accounts daemon's behavior at this github
    – Fady
    Nov 28, 2018 at 18:07
  • You can also ask for improving the OS Login document by clicking on the feedback button on top of the page. But as I mentioned the email format is a standard, and you can not change that behavior. In your feedback, you may also ask for manipulating user names when using OS Login as a new feature. Furthermore, You can repost your question at serverfault.com as an alternative to Superuser
    – Fady
    Nov 29, 2018 at 15:12
0

I have full admin rights to my project and I had the same issue when I set "enable-oslogin" to TRUE to speed up connecting to my VM.

After some searching, I found this page: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys#locatesshkeys and clicked the "Go to the Metadata page" button. Then I clicked on "Metadata" > "Edit". I set the key "enable-oslogin" value to FALSE.

I was able to SSH in (it took a little longer as expected) as my original user. I hope this helps!

0

I had the same problem. Haven't found a proper solution but a possible workaround consists of adding lines to the ~/.bashrc or ~/.bash_profile:

cd /home/{preferred_username}
source /home/{preferred_username}/.bashrc (or any file of your choosing which adds user based settings for your environment)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.