Getting started with the serial console
The serial console allows you to access a VM regardless of the network or OS status. For example, you can use the console to troubleshoot VM issues or when there are problems with SSH access.
To use the serial console, you need the сompute.admin
or editor
role.
Serial console access is disabled by default.
Warning
When assessing the risk of enabling access via the serial console, consider the following:
-
The VM can still be managed from the internet even if there is no external IP address.
To access the VM serial console from the Nebius Israel management console, a user must be authenticated in the Nebius Israel management console and have the proper rights to the VM. One can access the VM serial console from an SSH client application (such as PuTTY) or the Nebius Israel CLI via SSH key authentication. To reduce the risk of web session hijacking, you should closely monitor your SSH key and make sure you terminate the web session. -
The session will be simultaneously shared by all users who have access to the serial console.
Users will be able to see each other's actions if concurrently watching the serial console's output. -
A valid session can be exploited by another user.
We recommend using the serial console only when absolutely necessary, grant access to a narrow group of people, and use strong VM passwords.
Make sure you disable access after you finish using the serial console.
Federated users can only connect to the serial console using the CLI or SSH. These users cannot access the serial console from the Nebius Israel management console.
Getting started
Before you enable serial console access on a VM:
-
Prepare the key pair (public and private keys) for SSH access to the VM. The serial console authenticates users via SSH keys.
-
Create a text file (for example,
sshkeys.txt
) and specify the following:<username>:<user's public SSH key>
Example of a text file for
yc-user
:yc-user:ssh-ed25519 AAAAB3Nza......OjbSMRX yc-user@example.com
By default, a user's SSH keys are stored in the
~/.ssh
directory of this user. You can get a public key by runningcat ~/.ssh/<public key name>.pub
.
Enabling the console when creating a VM from a public image
To enable access to the serial console when creating a VM, set the serial-port-enable
parameter in the metadata to 1
.
If you don't have the Nebius Israel command line interface yet, install and initialize it.
The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name
or --folder-id
parameter.
-
View a description of the CLI create VM command:
yc compute instance create --help
-
Select a public image based on a Linux OS (such as Ubuntu).
To get a list of available images using the Nebius Israel CLI, run this command:
yc compute image list --folder-id standard-images
Result:
+----------------------+-------------------------------------+--------------------------+----------------------+--------+ | ID | NAME | FAMILY | PRODUCT IDS | STATUS | +----------------------+-------------------------------------+--------------------------+----------------------+--------+ ... | fdvk34al8k5n******** | centos-7-1549279494 | centos-7 | dqni65lfhvv2den5gtv9 | READY | | fdv7ooobjfl3******** | windows-2016-gvlk-1548913814 | windows-2016-gvlk | dqnnc72gj2ist3ktjj1p | READY | | fdv4f5kv5cvf******** | ubuntu-1604-lts-1549457823 | ubuntu-1604-lts | dqnnb6dc7640c5i968ro | READY | ... +----------------------+-------------------------------------+--------------------------+----------------------+--------+
-
Create a VM in the default folder:
yc compute instance create \ --name first-instance \ --zone il1-a \ --network-interface subnet-name=default-a,nat-ip-version=ipv4 \ --create-boot-disk image-folder-id=standard-images,image-family=ubuntu-1604-lts \ --metadata-from-file ssh-keys=sshkeys.txt \ --metadata serial-port-enable=1
This command will create a VM:
- With Ubuntu.
- Named
first-instance
. - In the
il1-a
availability zone. - With the serial console active.
A user named
yc-user
will be automatically created in the VM's OS with the specified public key.
-
View a description of the CLI create VM command:
yc compute instance create --help
-
Select a public Windows-based image.
To get a list of available images using the Nebius Israel CLI, run this command:
yc compute image list --folder-id standard-images
Result:
+----------------------+-------------------------------------+--------------------------+----------------------+--------+ | ID | NAME | FAMILY | PRODUCT IDS | STATUS | +----------------------+-------------------------------------+--------------------------+----------------------+--------+ ... | fdvk34al8k5n******** | centos-7-1549279494 | centos-7 | dqni65lfhvv2den5gtv9 | READY | | fdv7ooobjfl3******** | windows-2016-gvlk-1548913814 | windows-2016-gvlk | dqnnc72gj2ist3ktjj1p | READY | | fdv4f5kv5cvf******** | ubuntu-1604-lts-1549457823 | ubuntu-1604-lts | dqnnb6dc7640c5i968ro | READY | ... +----------------------+-------------------------------------+--------------------------+----------------------+--------+
-
Create a VM in the default folder:
yc compute instance create \ --name win-instance \ --metadata-from-file user-data=metadata.yaml \ --zone il1-a \ --network-interface subnet-name=default-c,nat-ip-version=ipv4 \ --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \ --metadata serial-port-enable=1
This command will create a VM:
- With Windows.
- Named
win-instance
. - In the
il1-a
availability zone. - With the serial console active.
The
Administrator
user with the password specified in themetadata.yaml
file will be automatically created in the VM's OS.
Enabling the console when updating a VM
To enable access to the serial console when updating a VM, set the serial-port-enable
parameter in the metadata to 1
.
-
Get a list of VMs in the default folder:
yc compute instance list
Result:
+----------------------+-----------------+---------------+---------+----------------------+ | ID | NAME | ZONE ID | STATUS | DESCRIPTION | +----------------------+-----------------+---------------+---------+----------------------+ | fhm0b28lgfp4tkoa3jl6 | first-instance | il1-a | RUNNING | my first vm via CLI | | fhm9gk85nj7gcoji2f8s | second-instance | il1-a | RUNNING | my second vm via CLI | +----------------------+-----------------+---------------+---------+----------------------+
-
Select the VM
ID
orNAME
(for example,first-instance
). -
Set
serial-port-enable=1
in the VM metadata:yc compute instance add-metadata \ --name first-instance \ --metadata-from-file ssh-keys=sshkeys.txt \ --metadata serial-port-enable=1
The command will start activating the serial console on the VM named
first-instance
.
Configuring a VM for serial port access
To configure access via the serial console, a VM must have a public IP address. You can look up the address in the management console
For the serial console to be available from the OS, the OS must be configured properly:
Linux
To connect to the Linux serial console, make sure that password authentication is disabled for SSH and set a password for the appropriate OS user, if necessary.
Disable SSH password authentication
Note
SSH connections using a login and password are disabled by default on public Linux images that are provided by Nebius Israel.
If you use your own image, make sure that SSH access with your username and password is disabled.
To disable SSH password authentication:
-
Open the configuration file on the SSH server (
/etc/ssh/sshd_config
by default). Only a superuser has read and write access to the file. -
Set the
PasswordAuthentication
option tono
. -
Restart the SSH server:
sudo systemctl restart ssh
Create a password for the Linux user
Sometimes an OS might request user credentials to access the VM. Before connecting to such VMs, create a local password for the default user.
To create a local password, use the CLI.
-
Get a list of VMs in the default folder:
yc compute instance list
Result:
+----------------------+-----------------+---------------+---------+----------------------+ | ID | NAME | ZONE ID | STATUS | DESCRIPTION | +----------------------+-----------------+---------------+---------+----------------------+ | fhm0b28lgfp4tkoa3jl6 | first-instance | il1-a | RUNNING | my first vm via CLI | | fhm9gk85nj7gcoji2f8s | second-instance | il1-a | RUNNING | my second vm via CLI | +----------------------+-----------------+---------------+---------+----------------------+
-
Select the VM
ID
orNAME
(for example,first-instance
). -
Get the public IP address of the VM.
yc compute instance get first-instance
In the command output, find the address of the VM in the
one_to_one_nat
section:... one_to_one_nat: address: <public IP address> ip_version: IPV4 ...
-
Connect to the VM. For more information, see Connecting to a VM.
-
Create a local password. In Linux, you can set a password using the
passwd
command:sudo passwd <username>
Example for
yc-user
:sudo passwd yc-user
-
Terminate the SSH session with the
exit
command.
Windows
An equivalent of the serial console in Windows is the Speicial Administration Console (SAC).
Note
If you created your VM after February 22, 2019, you do not need to configure anything else: the SAC is enabled by default.
If you created the VM before February 22, 2019, you need to update the Windows registry to connect to the SAC:
-
Launch the command line or the PowerShell and run:
bcdedit /ems "{current}" on The operation completed successfully. bcdedit /emssettings EMSPORT:2 EMSBAUDRATE:115200 The operation completed successfully.
-
Restart the VM.
Learn more about the terminal in the Windows serial console (SAC).