2

I am trying to copy local files to /var/www/.

The instance has two sets of keys. One for the instance creator that's generated by default and one for remote access that I have set up manually.

I have successfully logged in via gcloud as the latter user, and I can change to root once I'm logged in. But when I try to log in with root privileges via root@instance-name or instance-creator-name@instance-name, I get Permission denied (publickey).

Do I need to generate a new key pair for the instance creator? Can the instance creator's private key be found somewhere (wouldn't that violate security)? Is there another way to log in as root?

Edit: The docs leaves that part unspecified.

The following example demonstrates copying a folder called css into the >default document directory and doing so as the root user because that user owns the /var/www remote directory:

$ gcloud compute copy-files ~/mysite/css root@<YOUR-INSTANCE>:/var/www

This should work according to the docs, but I get Permission denied instead. Thinking I might have messed up my SSH configuration, I forced gcloud to use the default private key and then my manually generated key, but neither worked.

Community
  • 1
Guybrush Threepwood
  • 121
  • 1
  • 3
  • I can't seem to reproduce: `gcloud compute instances create --zone=us-central1-f ssh-root-test && gcloud compute copy-files --zone=us-central1-f /tmp/foo root@ssh-root-test:/var/` works. Which image are you using? Has it been modified? `gcloud compute ssh` just uses regular SSH along with some Compute Engine-specific bits to get the key onto the instance–you can debug by checking e.g. the SSH daemon settings on the server, `/etc/root/.ssh/authorized_keys`, etc. – Zachary Newman Jan 05 '16 at 00:41
  • @ZacharyNewman I created the instance via the web interface before, so the key would have to be sync'd after the fact (presumably by gcloud automatically). I just started a new instance from the command line and I logged in as root without issues. It still bugs me that I couldn't do it with my original instance, so I'll leave the question in case someone has a workaround. But big thanks for your help, I can move on now! – Guybrush Threepwood Jan 05 '16 at 01:03
  • Yes, `gcloud` handles sync-ing the key. If you'd really like to do this with your initial instance, you'll have to dig a little bit into its SSH settings. It works no differently from any other \*nix host, except that the `.authorized_keys` files are automatically populated. In any event, glad you've gotten it working. – Zachary Newman Jan 05 '16 at 01:53

2 Answers2

1

For security reasons, the standard Google images do not provide the ability to connect directly as root. The instance creator and any users that were added using the metadata sshKeys value are automatically administrators to the account, with the ability to run sudo without requiring a password like you mentioned.

Although it is not recommended, you can modify

/etc/ssh/sshd_config

and restart sshd to change this policy

George
  • 639
  • 3
  • 6
0

Install the google cloud sdk locally on your machine. This will automatically log you into google and setup the necessary permissions. Makes life much easier: https://cloud.google.com/sdk/downloads

LittleBuddha
  • 1
  • 1