> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Troubleshoot issues with an SSH connection

> Fix SSH connection failures on Gcore virtual machines and bare metal servers, including key, username, public IP, and firewall problems.

SSH connections to Virtual Machines and Bare Metal servers use the key from [SSH keys](/cloud/virtual-instances/connect/connect-to-your-instance-via-ssh) or [Bare Metal SSH](/cloud/bare-metal-servers/connect-to-your-bare-metal-server-via-ssh). Most failures trace back to a misconfigured key, the wrong default username, a missing public IP, or a blocked firewall port.

## Cannot log in as root. Permission denied error

Gcore images have root SSH login disabled by default for security reasons.

The default username depends on the operating system. During creation, the portal shows it as `ssh [username]@ipaddress`.

| Operating system | Default username |
| - | - |
| Ubuntu | `ubuntu` |
| Debian | `debian` |
| Fedora | `fedora` |
| CentOS | `cloud-user` |
| Rocky Linux | `rocky` |
| SUSE | `sles` |
| Fedora-CoreOS | `core` |
| Windows | `Admin` (RDP only) |

The same login is shown beside **Access to Console**:

**Virtual Machine**

Navigate to **Cloud** > **Virtual Instances** and open the Virtual Machine.

**Bare Metal**

Navigate to **Cloud** > **Bare Metal** and open the server.

After connecting with the default user, switch to root with:

```sh theme={null}
sudo -i
```

> [!NOTE]
>
> Custom images may have different default usernames or allow root login. Check with the image provider for the specific access credentials.

## No password received via email

Gcore does not send server credentials by email. Linux servers use SSH keys by default. If password access through the console is required for recovery, configure a console password when creating the server.

**Virtual Machine**

Set the [console password](/cloud/virtual-instances/customize-initial-setup-for-your-instance#set-a-password-for-a-virtual-machine) in **User data** under **Additional options**.

**Bare Metal**

For Linux, add a [password script](/cloud/bare-metal-servers/connect-to-your-bare-metal-server-via-ssh#connect-with-a-password) in the **User data** field. For Windows, enter the password on the [creation form](/cloud/bare-metal-servers/create-a-bare-metal-server).

## Lost SSH key and cannot connect

If a console password was set at creation:

**1. Open Access to Console**

[Log in](/cloud/virtual-instances/connect/connect-to-your-instance-via-control-panel#connect-to-a-linux-instance) with the username beside the button.

**2. Append the public key**

```bash theme={null}
mkdir -p ~/.ssh
chmod 700 ~/.ssh
printf '%s\n' 'PUBLIC_KEY' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
```

Replace `PUBLIC_KEY` with the OpenSSH public key on one line.

If no console password was set, open a [root shell in recovery mode](/cloud/virtual-instances/troubleshooting/recover-ssh-access-via-recovery-mode), then [install a public key](/cloud/virtual-instances/troubleshooting/recover-ssh-access-via-recovery-mode#install-a-public-key). On a Bare Metal server, reinstall with a new SSH key when the GRUB menu has no recovery mode entry.

> [!TIP]
>
> Add more than one key during that setup. Set a console password in **User data**, so the console opens without the SSH key.

## Connection timed out

On a Virtual Machine, check whether the attached security group allows SSH.

**1. Open the attached security group**

In **Cloud** > **Networking** > **Security Groups**, open the group on the Virtual Machine. [Security groups](/cloud/networking/add-and-configure-a-firewall) include an SSH template for this port.

**2. Allow inbound TCP port 22**

| Protocol | Port | Source |
| - | - | - |
| TCP | 22 | 0.0.0.0/0 |

**3. Allow ICMP for connectivity testing**

| Protocol | Type | Code | Source |
| - | - | - | - |
| ICMP | Any | Any | 0.0.0.0/0 |

The default security group already includes these rules. Select the default group when creating a Virtual Machine to avoid misconfiguring a custom security group.

## Permission denied (publickey) error

PuTTY and OpenSSH use different public key formats.

**1. Use an OpenSSH public key**

The key must start with `ssh-rsa AAAA...` or `ssh-ed25519 AAAA...`. A key that starts with `BEGIN SSH2 PUBLIC KEY` will not work.

**2. Copy the PuTTYgen OpenSSH field**

The field is **Public key for pasting into OpenSSH authorized\_keys file**, at the top of the window. **Save public key** writes a different format.

## No floating (public) IP address

A server created on a private subnet can have no public IP. SSH from an external network cannot reach the internal address, so attach a [floating IP](/cloud/networking/ip-address/create-and-configure-a-floating-ip-address).

## Cannot connect to a Windows server

For Windows servers, use Remote Desktop instead of SSH. Connect to the public IP shown on the server page. Remote Desktop uses TCP port 3389, and on Windows PCs the client is installed by default.

## Network appliance images (FortiGate, MikroTik)

These Virtual Machine images use their own authentication, not an SSH key from **SSH Keys**.

| Appliance | Default username | Default password |
| - | - | - |
| FortiGate | `admin` | empty (new password required on first login) |
| MikroTik CHR | `admin` | empty |

Use **Access to Console** on the Virtual Machine page for the initial login. After initial configuration, use the access methods supported by the appliance.