About OS Login

This page describes the OS Login service and how it works. To learn how to set up OS Login, see Set up OS Login.

Use OS Login to manage SSH access to your instances using IAM without having to create and manage individual SSH keys. OS Login maintains a consistent Linux user identity across Compute Engine instances and is the recommended way to manage many users across multiple compute instances or projects.

Benefits of OS Login

OS Login simplifies SSH access management by linking your Linux user account to your Google identity. Administrators can easily manage access to instances at either an instance or project level by setting IAM permissions.

OS Login provides the following benefits:

  • Automatic Linux account lifecycle management - You can directly tie a Linux user account to a user's Google identity so that the same Linux account information is used across all instances in the same project or organization.

  • Fine grained authorization using Google IAM - Project and instance-level administrators can use IAM to grant SSH access to a user's Google identity without granting a broader set of privileges. For example, you can grant a user permissions to log into the system, but not the ability to run commands such as sudo. Google checks these permissions to determine whether a user can log into a compute instance.

  • Automatic permission updates - With OS Login, permissions are updated automatically when an administrator changes IAM permissions. For example, if you remove IAM permissions from a Google identity, then access to compute instances is revoked. Google checks permissions for every login attempt to prevent unwanted access.

  • Support for certificate-based authentication - You can use SSH certificate authentication to connect to compute instances that use OS Login. For more information, see Require SSH certificates with OS Login.

  • Integration with audit logging - OS Login provides audit logging that you can use to monitor connections to compute instances for OS Login users.

OS Login IAM roles

OS Login uses IAM to authorize login access. You can grant OS Login IAM roles at the instance, folder, or organization level. OS Login provides the following predefined roles:

  • roles/compute.osLogin: grants login access without sudo access to compute instances.
  • roles/compute.osAdminLogin: grants login access with sudo access to compute instances.

For guidance on assigning OS Login IAM roles, see Assign OS Login IAM roles.

How OS Login works

When OS Login is enabled, Compute Engine performs configurations on compute instances and the Google accounts of OS Login users.

Compute instance configuration

When you enable OS Login, users connect by using short-lived SSH certificates that are signed by a certificate authority that OS Login manages. The compute instance verifies each certificate against the OS Login certificate authority and checks with the OS Login service that the user is authorized to log in.

You can configure an authorized_keys file to provision access for a local user account even when OS Login is enabled. SSH public keys that are configured in the authorized_keys file are used to authenticate user login attempts by the local user. Local user accounts and OS Login users must have different usernames and UIDs.

For more information about the OS Login components, review the OS Login GitHub page.

User account configuration

OS Login configures your user account with POSIX information, including a username, when you do any of the following:

  • Connect to an OS Login-enabled compute instance using the Google Cloud console
  • Connect to an OS Login-enabled compute instance using the gcloud CLI

OS Login configures POSIX accounts with the following values:

  • Username: the value of the user's google.posix_username attribute mapping in their workforce identity pool.

  • UID: a unique, randomly-generated POSIX-compliant user ID.

  • GID: a POSIX-compliant group ID that matches the UID.

  • Home directory: the path to the user's home directory.

Limitations

OS Login isn't supported on all compute instance configurations. For more information, see OS Login limitations.

What's next