<commit_before>---
title: Accessing Apps with Diego SSH
---

<strong><%= modified_date %></strong>

This page assumes you are using cf CLI v6.13.0 or later.

This topic describes how to SSH into a Cloud Foundry deployed application instance. You can start an SSH session to an app instance from the CLI. You can also enable, disable, and check SSH permission for an app from the CLI. 

## <a id="ssh-commands"></a>cf CLI SSH Commands

### <a id="enable-disable-ssh"></a>Enabling and Disabling SSH Access to Apps
The CLI supports enabling and disabling SSH access to applications. Run `cf enable` to allow SSH access to all instances of the app, or `cf disable` to disallow access.
<pre class="terminal">
$ cf enable <MY-AWESOME-APP>
</pre>

<pre class="terminal">
$ cf disable <MY-AWESOME-APP>
</pre>

### <a id="report-ssh-app-status"></a>Checking SSH Permission for Apps
To check whether you can access an app with SSH, run `cf ssh-enabled`.

<pre class="terminal">
$ cf ssh-enabled <MY-AWESOME-APP>
ssh support is disabled for '<span><</span>MY-AWESOME-APP>'
</pre>

### <a id="ssh-command"></a>The SSH Command
If your app is running on Diego with SSH enabled and your operator has configured SSH access to be publicly routable, run `cf ssh <APP-NAME>` in the terminal to start an interactive SSH session in instance index 0 of your app.
<pre class='terminal'>
$ cf ssh <MY-AWESOME-APP>
</pre>

To target a different instance index with `cf ssh`, supply it via the `-i` flag.

The `cf ssh` command also supports executing commands inside the app instance and forwarding local ports to it via the `-L` flag.

### <a id="configure-ssh-access-spaces"></a> Enabling and Disabling SSH Access for Spaces
In addition to configuring SSH access to applications, you can also enable and disable SSH access at the space level. 

Allow SSH access for the space
<pre class="terminal">
$ cf allow-space-ssh <SPACE-NAME>
</pre>

Disallow SSH access for the space
<pre class="terminal">
$ cf disallow-space-ssh <SPACE-NAME>
</pre>

### <a id="report-ssh-space-status"></a>Checking SSH Permission for Spaces
You can check whether SSH access for the space is allowed
<pre class="terminal">
$ cf space-ssh-allowed <SPACE-NAME>
</pre>

### <a id="ssh-auth-code"></a>Get SSH Code for Proxy Authentication
This command can be used to obtain a one-time authorization code that can be used as an SSH password with either the cf CLI or another SSH client
<pre class="terminal">
$ cf ssh-code
</pre>

## <a id="other-ssh-access"></a>SSH Access without cf CLI

You can connect to your SSH-enabled app instance via other SSH clients provided that deployment allows SSH access at the platform, space and app level. The Cloud Controller `/v2/info` endpoint contains an `app_ssh_endpoint` field with the domain name and port for the externally available SSH endpoint, and an `app_ssh_host_key_fingerprint` field with the fingerprint of the host key for the deployment. 

To connect to a particular instance of your app, run `ssh -p SSH-PORT cf:APP-GUID/APP-INSTANCE-INDEX@SSH-DOMAIN`.

To transfer files with `scp`, run `ssh -P SSH-PORT -o User=cf:APP-GUID/APP-INSTANCE-INDEX SSH-DOMAIN:REMOTE-FILE-TO-RETRIEVE LOCAL-FILE-DESTINATION`

## <a id="proxy-authentication"></a>Diego SSH Proxy Authentication and Daemon Discovery

Clients authenticate with the proxy using a specially formed user name that
describes the `cf` authentication domain and target container and a password that
contains the appropriate credentials for the domain.

The proxy supports authentication against a `cf` domain and can be enabled independently with
command line arguments.

### Authentication via Cloud Controller and UAA
<commit_msg>Modifies formatting<commit_after>---
title: Accessing Apps with Diego SSH
---

<strong><%= modified_date %></strong>

This page assumes you are using cf CLI v6.13.0 or later.

This topic describes how to SSH into a Cloud Foundry deployed application instance. You can start an SSH session to an app instance from the CLI. You can also enable, disable, and check SSH permission for an app from the CLI. 

## <a id="ssh-commands"></a>cf CLI SSH Commands

### <a id="enable-disable-ssh"></a>Enabling and Disabling SSH Access to Apps
The CLI supports enabling and disabling SSH access to applications. Run `cf enable` to allow SSH access to all instances of the app, or `cf disable` to disallow access.
<pre class="terminal">
$ cf enable MY-AWESOME-APP
</pre>

<pre class="terminal">
$ cf disable MY-AWESOME-APP
</pre>

### <a id="report-ssh-app-status"></a>Checking SSH Permission for Apps
To check whether you can access an app with SSH, run `cf ssh-enabled`.

<pre class="terminal">
$ cf ssh-enabled MY-AWESOME-APP
ssh support is disabled for 'MY-AWESOME-APP'
</pre>

### <a id="ssh-command"></a>The SSH Command
If your app is running on Diego with SSH enabled and your operator has configured SSH access to be publicly routable, run `cf ssh <APP-NAME>` in the terminal to start an interactive SSH session in instance index 0 of your app.
<pre class='terminal'>
$ cf ssh MY-AWESOME-APP
</pre>

To target a different instance index with `cf ssh`, supply it via the `-i` flag.

The `cf ssh` command also supports executing commands inside the app instance and forwarding local ports to it via the `-L` flag.

### <a id="configure-ssh-access-spaces"></a> Enabling and Disabling SSH Access for Spaces
In addition to configuring SSH access to applications, you can also enable and disable SSH access at the space level. 

Allow SSH access for the space
<pre class="terminal">
$ cf allow-space-ssh SPACE-NAME
</pre>

Disallow SSH access for the space
<pre class="terminal">
$ cf disallow-space-ssh SPACE-NAME
</pre>

### <a id="report-ssh-space-status"></a>Checking SSH Permission for Spaces
You can check whether SSH access for the space is allowed
<pre class="terminal">
$ cf space-ssh-allowed SPACE-NAME
</pre>

### <a id="ssh-auth-code"></a>Get SSH Code for Proxy Authentication
This command can be used to obtain a one-time authorization code that can be used as an SSH password with either the cf CLI or another SSH client
<pre class="terminal">
$ cf ssh-code
</pre>

## <a id="other-ssh-access"></a>SSH Access without cf CLI

You can connect to your SSH-enabled app instance via other SSH clients provided that deployment allows SSH access at the platform, space and app level. The Cloud Controller `/v2/info` endpoint contains an `app_ssh_endpoint` field with the domain name and port for the externally available SSH endpoint, and an `app_ssh_host_key_fingerprint` field with the fingerprint of the host key for the deployment. 

To connect to a particular instance of your app, run `ssh -p SSH-PORT cf:APP-GUID/APP-INSTANCE-INDEX@SSH-DOMAIN`.

To transfer files with `scp`, run `ssh -P SSH-PORT -o User=cf:APP-GUID/APP-INSTANCE-INDEX SSH-DOMAIN:REMOTE-FILE-TO-RETRIEVE LOCAL-FILE-DESTINATION`

## <a id="proxy-authentication"></a>Diego SSH Proxy Authentication and Daemon Discovery

Clients authenticate with the proxy using a specially formed user name that
describes the `cf` authentication domain and target container and a password that
contains the appropriate credentials for the domain.

The proxy supports authentication against a `cf` domain and can be enabled independently with
command line arguments.

### Authentication via Cloud Controller and UAA

{'fraction_non_alphanumeric': 0.09207126342989257, 'fraction_numerical': 0.0016319869441044472, 'mean_word_length': 4.550188679245283, 'pattern_counts': {'":': 0, '<': 89, '<?xml version=': 0, '>': 89, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '223900', 'n_tokens_mistral': 2230, 'n_tokens_neox': 2041, 'n_words': 1013}