{"slug":"ssh-into-a-linux-vm","title":"SSH into a Linux VM","tags":["tailscale"],"agent_summary":"Last validated: Dec 8, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# SSH into a Linux VM\r\n\r\nLast validated: Dec 8, 2025\r\n\r\nThis topic provides details about making an SSH session to a Linux VM on your Tailscale network (known as a tailnet).\r\n\r\n## [Prerequisites](https://tailscale.com/docs/how-to/connect-ssh-linux-vm\\#prerequisites)\r\n\r\n- You need a [Tailscale account](https://tailscale.com/docs/how-to/quickstart)\r\n- You need a Linux VM. The following topics provide details for setting up a Linux VM using common cloud providers:\r\n - [Create a Linux VM on Azure](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/quick-create-portal?tabs=ubuntu)\r\n - [Create a Linux VM on AWS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EC2_GetStarted.html)\r\n - [Create a Linux VM on GCP](https://cloud.google.com/compute/docs/create-linux-vm-instance)\r\n- You need [Tailscale installed on your Linux VM](https://tailscale.com/docs/install/linux)\r\n- You need [Tailscale installed on your local machine](https://tailscale.com/download)\r\n\r\n## [Configure Tailscale SSH](https://tailscale.com/docs/how-to/connect-ssh-linux-vm\\#configure-tailscale-ssh)\r\n\r\n1. Start by accessing your VM to install Tailscale.\r\n\r\n\r\n\r\nThis will most likely be the cloud-provided SSH mechanism and may require you to **temporarily** open up port `22` on that VM to your corporate network or the internet.\r\n\r\n2. In a terminal window on the VM, run the [`tailscale set`](https://tailscale.com/docs/reference/tailscale-cli/up) command to advertise SSH for that VM:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\ntailscale set --ssh\r\n```\r\n\r\n3. Open the [Access controls](https://login.tailscale.com/admin/acls) page of the Tailscale admin console and add the following lines to your tailnet policy file to allow network connectivity to the VM:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"\"],\\\r\n \"dst\": [\"\"],\\\r\n \"ip\": [\"22\"]\\\r\n }\\\r\n]\r\n```\r\n\r\n\r\n\r\n\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n\r\n\r\nYou can find your VM's Tailscale IP address on the [Machines](https://login.tailscale.com/admin/machines) page of the admin console, and you can find your Tailscale username on the [Users](https://login.tailscale.com/admin/users) page. You don't need to replace existing access control policies if you have any, just add this new rule. Here's an example:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"john.doe@domain.com\"],\\\r\n \"dst\": [\"100.64.65.66\"],\\\r\n \"ip\": [\"22\"]\\\r\n }\\\r\n]\r\n```\r\n\r\n\r\n\r\n\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n4. In the same tab, add the following rules to the SSH section of your tailnet policy file to allow SSH access to the VM:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\n\"ssh\": [\\\r\n { \"action\": \"accept\",\\\r\n \"src\": [\"your tailscale username\"],\\\r\n \"dst\": [\"autogroup:self\"],\\\r\n \"users\": [\"root\",\"autogroup:nonroot\", \"\"]\\\r\n }\\\r\n],\r\n```\r\n\r\n\r\n\r\n\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n5. If you have a local username (such as `local-user`) defined on the VM, you should add it to the `users` array in the `ssh` section. You don't need to replace existing SSH policies if you have any, just add this new rule. Here's an example:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```json\r\n\"ssh\": [\\\r\n { \"action\": \"accept\",\\\r\n \"src\": [\"john.doe@example.com\"],\\\r\n \"dst\": [\"autogroup:self\"],\\\r\n \"users\": [\"root\",\"autogroup:nonroot\", \"local-user\"]\\\r\n }\\\r\n],\r\n```\r\n\r\n\r\n\r\n\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n\r\n## [Use Tailscale SSH](https://tailscale.com/docs/how-to/connect-ssh-linux-vm\\#use-tailscale-ssh)\r\n\r\n1. In a terminal window on your local machine, SSH to your VM:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\nssh \r\n```\r\n\r\n2. If you need to use your local account just reference it before the IP address (`user@IP`) when running the SSH command. You can also use the [MagicDNS](https://tailscale.com/docs/features/magicdns) hostname of the machine. For example:\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n```shell\r\nssh local-user@100.64.65.66\r\n```\r\n\r\n3. If you haven't already, you can close the SSH port on your cloud VM and re-run the Tailscale SSH command to verify it is working.\r\n\r\n\r\nWe strongly recommend that you do not keep the SSH port exposed for prolonged periods of time especially to the internet. If you need to open this port for this test, after you are done testing, make sure you close the port or delete your test VM.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

SSH into a Linux VM

\n

Last validated: Dec 8, 2025

\n

This topic provides details about making an SSH session to a Linux VM on your Tailscale network (known as a tailnet).

\n

Prerequisites

\n\n

Configure Tailscale SSH

\n
    \n
  1. Start by accessing your VM to install Tailscale.
    2. \n
\n

This will most likely be the cloud-provided SSH mechanism and may require you to temporarily open up port 22 on that VM to your corporate network or the internet.

\n
    \n
  1. In a terminal window on the VM, run the tailscale set command to advertise SSH for that VM:
    2. \n
\n
tailscale set --ssh\n
\n
    \n
  1. Open the Access controls page of the Tailscale admin console and add the following lines to your tailnet policy file to allow network connectivity to the VM:
    2. \n
\n
\"grants\": [\\\r\n     {\\\r\n       \"src\": [\"<your tailscale username>\"],\\\r\n       \"dst\": [\"<your vm's tailscale ip address>\"],\\\r\n       \"ip\": [\"22\"]\\\r\n     }\\\r\n]\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

You can find your VM's Tailscale IP address on the Machines page of the admin console, and you can find your Tailscale username on the Users page. You don't need to replace existing access control policies if you have any, just add this new rule. Here's an example:

\n
\"grants\": [\\\r\n     {\\\r\n       \"src\": [\"john.doe@domain.com\"],\\\r\n       \"dst\": [\"100.64.65.66\"],\\\r\n       \"ip\": [\"22\"]\\\r\n     }\\\r\n]\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n
    \n
  1. In the same tab, add the following rules to the SSH section of your tailnet policy file to allow SSH access to the VM:
    2. \n
\n
\"ssh\": [\\\r\n     { \"action\": \"accept\",\\\r\n       \"src\": [\"your tailscale username\"],\\\r\n       \"dst\": [\"autogroup:self\"],\\\r\n       \"users\": [\"root\",\"autogroup:nonroot\", \"<your-local-username>\"]\\\r\n     }\\\r\n],\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n
    \n
  1. If you have a local username (such as local-user) defined on the VM, you should add it to the users array in the ssh section. You don't need to replace existing SSH policies if you have any, just add this new rule. Here's an example:
    2. \n
\n
\"ssh\": [\\\r\n     { \"action\": \"accept\",\\\r\n       \"src\": [\"john.doe@example.com\"],\\\r\n       \"dst\": [\"autogroup:self\"],\\\r\n       \"users\": [\"root\",\"autogroup:nonroot\", \"local-user\"]\\\r\n     }\\\r\n],\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Use Tailscale SSH

\n
    \n
  1. In a terminal window on your local machine, SSH to your VM:
    2. \n
\n
ssh <your-vm-ip-address>\n
\n
    \n
  1. If you need to use your local account just reference it before the IP address (user@IP) when running the SSH command. You can also use the MagicDNS hostname of the machine. For example:
    2. \n
\n
ssh local-user@100.64.65.66\n
\n
    \n
  1. If you haven't already, you can close the SSH port on your cloud VM and re-run the Tailscale SSH command to verify it is working.
    2. \n
\n

We strongly recommend that you do not keep the SSH port exposed for prolonged periods of time especially to the internet. If you need to open this port for this test, after you are done testing, make sure you close the port or delete your test VM.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}