startup.sh

#! /bin/bash
# enables PasswordAuthentication
# creates a user

# You can query a metadata server only from its associated instance. 
# You cannot query an instance's metadata from another instance or
# directly from your local computer. 
# For example, you would send a curl or wget command from the 
# instance to its metadata server.
# see https://developers.google.com/compute/docs/metadata
USER=$(curl "http://metadata/computeMetadata/v1/instance/attributes/user" -H "Metadata-Flavor: Google")
PASS=$(curl "http://metadata/computeMetadata/v1/instance/attributes/pass" -H "Metadata-Flavor: Google")
CONFIG=/etc/ssh/sshd_config

/bin/cp -p $CONFIG $CONFIG.orig &&
/usr/bin/awk '
$1=="PasswordAuthentication" {$2="yes"}
{print}
' $CONFIG.orig > $CONFIG
/etc/init.d/ssh restart
/usr/sbin/useradd -s /bin/bash -m -d /home/$USER $USER
echo $USER:$PASS | /usr/sbin/chpasswd
/usr/bin/passwd -e $USER

Here's a command to create the instance in such a way that it uses this startup script:

(don't forget to substitute values where marked)

gcutil addinstance simple-apache \
--service_account_scope=storage-ro  \
--metadata=startup-script-url:gs://<bucket_name>/startup.sh \
--project=<project_name> \
--metadata=user:<username> \
--metadata=pass:<some_pw> \
--zone=europe-west1-a \
--machine_type=f1-micro \
--image=debian-7