# Authentication requirements > The credentials Cloud Management Platform (CMP) needs to reach a target server, and where to set them --- Site [llms.txt](/llms.txt) --- Cloud Management Platform (CMP) must be able to authenticate with the remote guest in order to interact with it. That is done with either a password or an SSH key, depending on the resource handler and OS involved. ## Passwords VMware relies on passwords for accessing VMs. Authentication with these servers requires a password and sometimes a username. Credentials can be set in several places: - **On the server's details page.** For a server that has already been provisioned, view or update its credentials here to match the VM's actual configuration. - **On the template.** Set credentials before provisioning so they are applied to new servers built from it. - **On the group, environment, or globally.** Set the **Password** and, if needed, **Username** parameters at any of these levels. - **On a remote script action.** Credentials set here override any set on the server when that action runs. These credentials are associated with the server during provisioning, so they are available for running remote scripts at provision time or later. The username must be provided explicitly unless it is `ubuntu` for Ubuntu servers, `root` for other \*nix distributions, or `Administrator` for Windows. When a remote script runs as a server action, it also prompts for credentials, so you can enter a username and password for that run only. Any credentials stored on the action or server are used as the default, with the script's own credentials taking precedence over the server's, but you can override them at runtime. Credentials entered this way can be saved to the server for future use. ## SSH keys Some cloud providers require SSH key authentication to provision and access VMs. By default, [AWS](/docs/cmp/configure/infrastructure/resource-handlers/aws/), [GCP](/docs/cmp/configure/infrastructure/resource-handlers/gcp/), [MAAS](/docs/cmp/configure/infrastructure/resource-handlers/maas/), and [Oracle](/docs/cmp/configure/infrastructure/resource-handlers/oracle-cloud-infrastructure/) rely on SSH keys. ### Authenticating servers To authenticate with servers and run scripts, CMP needs the key material for each key pair used to build new servers. For these resource handlers, CMP reads the list of **public** SSH keys that have been uploaded or imported into your cloud provider, which you can then select when provisioning once key material is available. 1. Upload or import your public SSH key into your cloud provider interface. 1. Open the **SSH Keys** tab of the resource handler. 1. Use the pencil icon to upload the **private** key material for that key, making it available to CMP. ### Running remote scripts CMP also supports generic, global SSH keys for running remote scripts over SSH on any resource handler. You are responsible for ensuring that a selected global key is valid for the server you point it to; neither CMP nor the resource handler configures the VM to accept it. Manage these global keys at **Admin** > **SSH Keys**. ### Uploading key material Key material must be raw private key material that has not been encrypted with a passphrase. Generate keys with the `-m PEM` flag. You can set SSH keys as credentials on a template, to propagate to servers at provisioning, or on a server that has already been provisioned, as long as it is not Windows and is not a server running scripts through VMware Tools. In either case, choose any global key or a key obtained from the resource handler that has material available and is associated with the environment. - As with usernames and passwords, an SSH key can be associated with a particular remote script action on its details page. - Only global SSH keys can be chosen for consistent use with an action. - A key set on a script overrides a key set on the server when that script runs. ## Special case: AWS Windows Windows VMs on AWS do not need a new authentication method. Use either of the two above, with one added fallback: - **If a password is provided**, CMP uses it directly, as described in [Passwords](#passwords). - **If no password is provided**, CMP attempts to retrieve the Administrator password from EC2 using the provided SSH key. This only succeeds if the VM is configured in EC2 so that `get_password_data` works. ## Related - [OS-specific requirements](/docs/cmp/use/orchestration/remote-scripts/os-specific-requirements/): what to enable on the target server for SSH or WinRM. - [Configure remote script method](/docs/cmp/use/orchestration/remote-scripts/configure-method/): choosing the execution method.