How to Configure Google Cloud OS Login for Centralized Two-Factor SSH Authentication

Historically, securing SSH access to Linux virtual machines on Google Cloud Platform (GCP) involved managing decentralized SSH key pairs. Developers would generate an RSA key on their local laptop, provide the public key to an administrator, and the administrator would manually inject it into the VM’s metadata or ~/.ssh/authorized_keys file. When a developer left the organization, finding and removing their keys across hundreds of VMs was nearly impossible, creating massive security vulnerabilities. Furthermore, standard SSH keys do not enforce Multi-Factor Authentication (MFA). To mathematically solve this identity crisis, Google engineered Cloud OS Login, a centralized architecture that binds Linux SSH access directly to Google Workspace (Cloud Identity), enabling dynamic key management and enforcing mandatory 2FA at the SSH protocol layer.

The Architecture of OS Login

When you enable OS Login, GCP fundamentally alters how the Linux Guest Environment authenticates SSH connections. It disables the legacy SSH metadata daemon (which injects public keys into authorized_keys files).

Instead, it configures the Linux system’s Pluggable Authentication Modules (PAM) and the Name Service Switch (NSS) to communicate directly with the Google Cloud IAM API.

When a developer attempts to SSH into the VM using the gcloud compute ssh command, the CLI dynamically generates an ephemeral SSH key pair locally. It then securely uploads the public key to the developer’s Google Cloud Identity profile (not the VM). When the connection reaches the VM, the Linux PAM module reaches out to the IAM API to verify two conditions:

1. Does this user possess the roles/compute.osLogin or roles/compute.osAdminLogin IAM permission on this specific VM?
2. Does the incoming SSH key mathematically match the ephemeral key currently associated with the user’s identity profile?

If both conditions are met, the connection is granted. If the user’s Google Workspace account is suspended by HR, their IAM permissions are instantly revoked, and their SSH access across the entire global GCP footprint is terminated in milliseconds.

Enabling OS Login and Enforcing 2FA

To deploy this architecture, you must enable the feature at the Project or Organization level utilizing the metadata server.

# Enable OS Login across the entire GCP Project
gcloud compute project-info add-metadata \
    --metadata enable-oslogin=TRUE

While OS Login centralizes identity, a compromised laptop could still allow an attacker to execute the gcloud compute ssh command utilizing the developer’s active session. To prevent this, you must explicitly enforce Two-Factor Authentication (2FA) for SSH.

# Enforce mandatory 2FA for all OS Login connections
gcloud compute project-info add-metadata \
    --metadata enable-oslogin-2fa=TRUE

This single command mathematically alters the PAM configuration on every Linux VM in the project. The next time a developer attempts to SSH into a VM, the connection will pause. The PAM module will reach out to Google Cloud Identity and trigger a 2FA challenge. The developer will receive a push notification on their registered mobile device (e.g., a Google Prompt or an authenticator app code request). The SSH shell will not spawn until the cryptographic challenge is satisfied.

Managing IAM Access and sudo Privileges

Because OS Login relies entirely on Google IAM, managing access becomes completely declarative. You no longer manage Linux groups (like the wheel or sudo group) locally on the VM.

To grant a developer standard, unprivileged SSH access to a specific VM (e.g., a web server):

gcloud compute instances add-iam-policy-binding prod-web-01 \
    --member="user:[email protected]" \
    --role="roles/compute.osLogin" \
    --zone="us-central1-a"

To grant a senior systems engineer administrative SSH access (allowing them to execute sudo su - without a password):

gcloud compute instances add-iam-policy-binding prod-web-01 \
    --member="user:[email protected]" \
    --role="roles/compute.osAdminLogin" \
    --zone="us-central1-a"

By migrating from decentralized, static SSH keys to Google Cloud OS Login with 2FA, enterprise security teams achieve absolute Zero Trust network access, mathematically linking Linux shell execution directly to the corporate identity provider.