How can I prevent GCE from copying ssh keys to all new instances?

Question

When I create a new VM instance via Cloud Console, homedirs are automatically created for users that I have created manually on previous instances, and ssh-keys are copied to ~/.ssh/authorized_keys in respective homedirs.

I don't want that! This is IMHO a serious security flaw.

I don't want any users automatically created, I don't want any ssh keys automatically copied.
How can I achieve that?

Answer 1

You can specify the specific users & SSH keys to use for an instance by setting the instance level sshKeys metadata key . You can also do this from the command line using gcutil's --authorized_ssh_keys option:

$ gcutil addinstance --authorized_ssh_keys=username1:/path/to/keyfile1,username2:/path/to/keyfile2,...

If you want to make sure that no instances get the full set of users/keys, you can remove the sshKeys project level metadata key. From the Console, click Compute Engine , then Metadata , then click the trash can icon next to the sshKeys key. You will then need to specify keys for each instance, or you will not be able to log in at all. (which may be what you want in a fully automated environment)

Note: Running gcutil ssh will generate a key-pair (if needed) and add it to the sshKeys key.

Answer 2

Google adds these ssh keys to the project ssh-keys automatically. So you need to block project-wide SSH keys: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys#block-project-keys

You can do it via meta-data:

"block-project-ssh-keys": "true"