> ## Documentation Index
> Fetch the complete documentation index at: https://docs.phala.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable SSH Access

> Connect to your CVM via SSH for debugging and management

<Warning>
  SSH works only on dev OS images. Select "dstack-dev" when you create your CVM. Production images have SSH turned off for security. You sign in with an SSH key. Passwords do not work.
</Warning>

The Phala CLI connects you through the secure gateway tunnel in one command.

## Prerequisites

* [Phala CLI](/phala-cloud/phala-cloud-cli/overview) (latest version)
* CVM deployed with Development OS

## Step 1: Configure SSH Keys

Start by adding your SSH keys in **Account Settings > SSH Keys** on the [Phala Cloud dashboard](https://cloud.phala.com/account/settings). You can add keys manually or sync them from GitHub. All saved keys are automatically added to every new CVM you deploy.

When creating a CVM, the SSH Authorization section lets you add one more public key just for that CVM. It is added alongside your account keys.

Your keys are copied into the CVM when it starts for the first time. Adding a key to your account later does not reach a CVM that is already running. To add a key to a running CVM, use **Code Update** and set the `DSTACK_ROOT_PUBLIC_KEY` environment variable.

### Why can't I sign in with a password?

Since dstack 0.5.6, the SSH server rejects password logins. Only keys work. `DSTACK_ROOT_PASSWORD` still sets the Linux root password inside the CVM, but SSH will turn it down no matter what you set it to. Add a public key instead.

## Step 2: Connect

```bash theme={"system"}
# Connect using phala.toml configuration
phala ssh

# Or specify the CVM name directly
phala ssh my-cvm
```

That's it. The CLI handles the gateway tunnel and SSH configuration automatically.

## Useful Options

The `phala ssh` command supports several options:

```bash theme={"system"}
# Preview the SSH command without connecting
phala ssh my-cvm --dry-run

# Enable verbose output for debugging
phala ssh my-cvm -v

# Forward a local port to the CVM
phala ssh my-cvm -- -L 8080:localhost:80
```

See the [CLI reference](/phala-cloud/phala-cloud-cli/ssh) for all options.

<Accordion title="Manual SSH Configuration">
  If you prefer manual configuration or need to customize your setup, use `phala ssh --dry-run` to generate the SSH config:

  ```bash theme={"system"}
  phala ssh my-cvm --dry-run
  ```

  This outputs a working SSH command you can adapt. The underlying mechanism uses OpenSSL to tunnel SSH through TLS:

  ```bash theme={"system"}
  Host my-cvm
      HostName <app-id>-22.<cluster>.phala.network
      User root
      Port 443
      ProxyCommand openssl s_client -quiet -connect %h:%p
  ```

  Replace `<app-id>` with your application ID and `<cluster>` with your cluster (e.g., `dstack-pha-prod7`).

  **macOS users:** If you encounter connection timeouts, you may have LibreSSL instead of OpenSSL. Install OpenSSL via Homebrew and use the full path: `/opt/homebrew/bin/openssl`.

  **Windows users:** Install OpenSSL via [Chocolatey](https://chocolatey.org/) (`choco install openssl`) and use the full path in ProxyCommand. Alternatively, use WSL where the Linux instructions work directly.
</Accordion>

## What You Can Do

Once connected, you have full access to debug and manage your CVM:

```bash theme={"system"}
# Check containers
docker ps -a
docker logs <container-name>

# Monitor resources
htop
docker stats

# Debug networking
curl http://localhost:8080
netstat -tulpn
```

<Tip>
  Remember to switch to a Production OS image when you're done debugging.
</Tip>

## Troubleshooting

| Issue              | Solution                                                                                                                        |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------- |
| Permission denied  | Check that Account Settings has the key you are using. Passwords are rejected. For a running CVM, use Code Update to add a key. |
| Connection refused | Confirm you deployed with Development OS, not Production                                                                        |
| Connection timeout | Run `phala ssh -v` to see detailed connection info                                                                              |

For more detailed troubleshooting, see [Networking Troubleshooting](/phala-cloud/networking/troubleshooting#ssh-access-denied).