# Passing SSH key **URL:** \ **Category:** Hail Query & hailctl\ **Created:** [March 29, 2022, 4:32pm UTC](https://discuss.hail.is/t/passing-ssh-key/2570 "2022-03-29T16:32:30Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jerome-f](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/jerome-f/32/708_2.png) [@jerome-f](https://discuss.hail.is/u/jerome-f)\ **Post date:** [March 29, 2022, 4:32pm UTC](https://discuss.hail.is/t/passing-ssh-key/2570/1 "2022-03-29T16:32:30Z")
Hi, I am launching dataproc cluster from using the Hailctl and i am not able to connect via ssh. This is due to the firewall restriction. Is there a way to pass ssh key when launching data proc via hailctl. ? ---
**Author:** ![danking](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/danking/32/43_2.png) [@danking](https://discuss.hail.is/u/danking)\ **Post date:** [March 29, 2022, 5:05pm UTC](https://discuss.hail.is/t/passing-ssh-key/2570/2 "2022-03-29T17:05:40Z")
Hey @jerome-f ! `hailctl dataproc cluster start` will pass any unrecognized arguments along to `gcloud dataproc create`. That said, if you’re having firewall issues, I don’t think an SSH key will fix the problem. ---
**Author:** ![jerome-f](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/jerome-f/32/708_2.png) [@jerome-f](https://discuss.hail.is/u/jerome-f)\ **Post date:** [March 29, 2022, 5:58pm UTC](https://discuss.hail.is/t/passing-ssh-key/2570/3 "2022-03-29T17:58:16Z")
Thanks Danking, So I am not able to connect/launch the notebook even though I am on the same network, or form a vm in the same instance. I dont know how to specify the cluster to inherit same firewall rules as the vm instance. ```auto `Existing host keys found in /home/XXX/.ssh/google_compute_known_hosts` `ssh: connect to host xx.xxx.xx.xxx port 22: Connection timed out` `Recommendation: To check for possible causes of SSH connectivity issues and get` ``` ---
**Author:** ![danking](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/danking/32/43_2.png) [@danking](https://discuss.hail.is/u/danking)\ **Post date:** [March 29, 2022, 8:52pm UTC](https://discuss.hail.is/t/passing-ssh-key/2570/4 "2022-03-29T20:52:40Z")
@jerome-f, I think you need to specify `--network` to place the cluster in the network which has the desired firewall rules? The `gcloud` man page describes that flag and a few related ones: ```auto --tags=TAG,[TAG,...] Specifies a list of tags to apply to the instance. These tags allow network firewall rules and routes to be applied to specified VM instances. See gcloud compute firewall-rules create(1) for more details. To read more about configuring network tags, read this guide: https://cloud.google.com/vpc/docs/add-remove-network-tags To list instances with their respective status and tags, run: $ gcloud compute instances list \ --format='table(name,status,tags.list())' To list instances tagged with a specific tag, tag1, run: $ gcloud compute instances list --filter='tags:tag1' At most one of these may be specified: --network=NETWORK The Compute Engine network that the VM instances of the cluster will be part of. This is mutually exclusive with --subnet. If neither is specified, this defaults to the "default" network. --subnet=SUBNET Specifies the subnet that the cluster will be part of. This is mutally exclusive with --network. ``` ---
**Author:** ![jerome-f](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/jerome-f/32/708_2.png) [@jerome-f](https://discuss.hail.is/u/jerome-f)\ **Post date:** [March 30, 2022, 5:20am UTC](https://discuss.hail.is/t/passing-ssh-key/2570/5 "2022-03-30T05:20:33Z")
Hi Danking, The Dataproc instance is on the network behind the firewall. I could ssh into using my ssh key file. I might have to launch jupyter lab from within the cluster trying to use `hailctl dataproc connect notebook`. ---
**Author:** ![danking](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/danking/32/43_2.png) [@danking](https://discuss.hail.is/u/danking)\ **Post date:** [March 30, 2022, 2:19pm UTC](https://discuss.hail.is/t/passing-ssh-key/2570/6 "2022-03-30T14:19:08Z")
Ah, @jerome-f , I think I understand what you’re trying to do. Unfortunately, `hailctl dataproc connect` does not pass through unrecognized arguments to `gcloud dataproc`. I’ve marked this as a feature request. In the meantime, you can use `--dry-run` to see the command we use. You can modify this command as necessary. In particular, I think you just need to add `--ssh-key-file=path/to/your/key` ```auto (base) # hailctl dataproc connect --dry-run dk notebook gcloud command: compute ssh dking@dk-m --zone=us-central1-b \ '--ssh-flag=-D 10000' \ '--ssh-flag=-N' \ '--ssh-flag=-f' \ '--ssh-flag=-n' ``` ---
**Author:** ![danking](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/danking/32/43_2.png) [@danking](https://discuss.hail.is/u/danking)\ **Post date:** [March 30, 2022, 2:55pm UTC](https://discuss.hail.is/t/passing-ssh-key/2570/7 "2022-03-30T14:55:30Z")
Here’s a PR to add the pass through functionality you need. [[hailctl] allow passthrough arguments to dataproc connect by danking · Pull Request #11710 · hail-is/hail · GitHub](https://github.com/hail-is/hail/pull/11710) ---
**Author:** ![jerome-f](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/jerome-f/32/708_2.png) [@jerome-f](https://discuss.hail.is/u/jerome-f)\ **Post date:** [March 30, 2022, 5:20pm UTC](https://discuss.hail.is/t/passing-ssh-key/2570/8 "2022-03-30T17:20:26Z")
Thanks for the reply Danking. ---
**Author:** ![jerome-f](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.hail.is/jerome-f/32/708_2.png) [@jerome-f](https://discuss.hail.is/u/jerome-f)\ **Post date:** [March 30, 2022, 5:30pm UTC](https://discuss.hail.is/t/passing-ssh-key/2570/9 "2022-03-30T17:30:28Z")
@danking I am not sure if this would be useful for everyone. But the current behavior of data proc create is to launch a Debian boot disk. My org does not like user to create custom images and requires to us to pick one of the hardened images pre provisioned (for data security etc. ) . hail dataproc create can have support to user specifying image with` --image=` (it is working now as pass through but `--image-version` is set so throws an error)