Google Compute Engine SSH – different username after switching to OS Login

google-cloud-platformgoogle-compute-enginessh

I created a Compute Engine VM (Ubuntu 18.04), and when I log into it using the SSH button in the VM instances list I'm logged in as user username.

After a while, I realised I needed to be able to use another SSH client as well. As per https://cloud.google.com/compute/docs/instances/connecting-advanced I enabled OS Login by adding a key-value pair in metadata, where key is enable-oslogin and value is TRUE.

I then tried to add my existing SSH key:

gcloud compute os-login ssh-keys add --key-file path/to/key.pub --ttl 0

which was successful except one major problem: it has added the key for user username_gmail_com and will only allow me to ssh to my VM as that user:

ssh username_gmail_com@myinstance

And it has also created that user on my VM. From the web interface, I'm logged in to the VM with that new user as well (/home/username_gmail_com). Of course, I can still access the original user's data (/home/username). When I disable OS Login the web interface logs me in as username again and SSH from another client is disabled.

  1. Why is the username different when enabling OS Login?
  2. Can I change the username with OS Login enabled?

Edit

There has been an addition to the docs explaining exactly this question. Check here: https://cloud.google.com/compute/docs/oslogin/ and on the page I mentioned above all the way at the bottom under "Expected login behaviors".

Best Answer

I asked this question here and got a clear answer.

Why is the username different between OS Login enabled and disabled?

OS Login ties your Linux user account to your Google identity so that you have a consistent username, UID, and other posix information, in every VM you log into.

[...]

In order to prevent uniqueness conflicts across different organizations (user@gmail.com and user@example.com) the domain name is included by default.

[...]

When OS Login is not enabled, the username is set in your SSH key which has no tie-in to a user's Google identity. The username is generated to be convenient, and none of the OS Login-specific concerns apply.

And can I influence the username when OS Login enabled?

The posix information is immutable for consumer identities (non-G Suite users).

So no, I can't, because I'm an individual and not an organisation.

In the end, I solved the inconveniece this caused me by simply recreating the server with OS Login enabled - that of course is one of the strengths of Compute Engine.

Related Question