Unable to SSH to Azure Arc Gateway VM

AZR-GP 20

Is it possible to SSH to the Azure Arc Gateway VM that is deployed by the onboarding script?

No credentials are provided at the time of deployment. The 3 yaml and the kubeconfig files created do not seem to help.

However, I can run the commands:

az arcappliance get-credentials

az arcappliance logs vmware

Looking at some of the log output there seems to be a user 'clouduser'.

Running ssh -v -i privatekey clouduser@ARC-RB-IP gives the following error:-

PTY allocation request failed on channel 0

Trying to add a command (eg ls) with ssh -v -i privatekey clouduser@ARC-RB-IP ls gives the following error:-

Unauthorized command: ls

Is it possible to get an ssh shell here?

Thanks.

Pranay Reddy Madireddy 4,250 Reputation points Microsoft External Staff

2025-03-25T16:22:04.4+00:00

Hi @AZR-GP
Just checking in to see if the below answer provided by @Alex Burlachenko helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Pranay Reddy Madireddy 4,250 Reputation points Microsoft External Staff

2025-03-27T18:58:29.5733333+00:00

Hi AZR-GP

We haven't heard back from you. Please reply if you have any questions in this matter and we will gladly continue the discussion.

Accepted answer

Alex Burlachenko 4,550 Reputation points

2025-03-24T13:24:12.34+00:00
Hi AZR-GP,

Direct SSH access to Azure Arc Gateway VMs is not supported by design for security reasons. But I would be happy offer to u a few alternatives

For logs

az arcappliance logs vmware --out-file logs.zip

To run commands

az arcappliance runcommand vmware

Docs for undertanding

Troubleshooting Guide

Security Boundaries

Best regards,

Alex

P.S. If my answer help to you, please Accept my answer
Please sign in to rate this answer.
AZR-GP 20 Reputation points

2025-04-09T16:28:03.85+00:00

Hi,

Thanks for that. It does answer the main question but generates another one:-

The 'az arcappliance run vmware' seems to be related to deployment but looking at troubleshooting there is a command 'az arcappliance troubleshoot command vmware'. However, this seems to require a scoped access key:-

C:\ProgramData\kva.ssh\scopedaccesskey does not exist. Please ensure a scoped access key was generated...

How can this be generated?

Thanks
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

0 additional answers

Your answer