Logging to EC2 for first time via SSH.
It's not able to open private key file. So I changed chmod to 700 but its still throwing same error. Please suggest how can I fix it.
Macs-MacBook-Pro:~ Macbook$ ssh -v -i ~/.ssh/aug1981.pem ubuntu#ec2-54-200-94-18.us-west-2.compute.amazonaws.com
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to ec2-54-200-94-18.us-west-2.compute.amazonaws.com [54.200.94.18] port 22.
debug1: Connection established.
debug1: identity file /Users/Macbook/.ssh/aug1981.pem type -1
debug1: identity file /Users/Macbook/.ssh/aug1981.pem-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian-5ubuntu1
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 8d:e2:20:42:95:c5:bc:14:42:10:a5:cf:40:d8:d9:fa
debug1: Host 'ec2-54-200-94-18.us-west-2.compute.amazonaws.com' is known and matches the RSA host key.
debug1: Found key in /Users/Macbook/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/Macbook/.ssh/aug1981.pem
debug1: could not open key file '/Users/Macbook/.ssh/aug1981.pem': Permission denied
debug1: No more authentication methods to try.
Permission denied (publickey).
Where is the file located the you downloaded from your EC2 instance?
Can you do an ls -la on the dir with the .pem so we can see who owns the .pem file?
Also did you setup any security measures on the EC2 instance like 192.168.0.0/24 can access port 22/tcp of this instance?
You have a permission denied error for trying to open the keyfile.
I would do a ls -la and see if your user actually owns the file and that it is set to permissions 0700.
If it is not owned by your user the you need to:
whoami # this will tell you your user's name
chown user aug1981.pem
Related
This is on AWS. I tried to launch a new Ubuntu instance (#2) with the same keypair that is associated with another Ubuntu instance (#1).
AWS instances are associated with keypairs at the time they are launched and cannot be changed once launched.
I can connect to instance #1 but can't connect to instance #2 using the same ssh command. I've checked my permissions and everything seems to be ok.
The key is in ~/AMI.pem.
I have chmod 600 on my home directory and chmod 400 on ~/AMI.pem, so it's only readable/writeable by me.
The instances are nearly identical, with the same security groups and keypairs, same version of Ubuntu, etc. Instance #1 has some additional packages installed. I verified both are associated with the same keypair called "AMI".
Connecting to #2:
USAU9900:ScrapeEdgar reedn$ ssh -i ~/AMI.pem -v ubuntu#54.67.18.96
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /Users/reedn/.ssh/config
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to 54.67.18.96 [54.67.18.96] port 22.
debug1: Connection established.
debug1: identity file /Users/reedn/AMI.pem type -1
debug1: identity file /Users/reedn/AMI.pem-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm#openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm#openssh.com none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 36:69:f6:95:b4:3c:f0:77:02:ab:02:01:af:c7:cc:6a
debug1: Host '54.67.18.96' is known and matches the RSA host key.
debug1: Found key in /Users/reedn/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/reedn/AMI.pem
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
*Permission denied (publickey).*
Connecting to instance #1:
USAU9900:ScrapeEdgar reedn$ ssh -i ~/AMI.pem -v ubuntu#54.183.77.100
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /Users/reedn/.ssh/config
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to 54.183.77.100 [54.183.77.100] port 22.
debug1: Connection established.
debug1: identity file /Users/reedn/AMI.pem type -1
debug1: identity file /Users/reedn/AMI.pem-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2 pat OpenSSH*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5-etm#openssh.com none
debug1: kex: client->server aes128-ctr hmac-md5-etm#openssh.com none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA a6:53:a0:99:b8:61:ef:fe:05:d3:fe:47:90:ea:de:b6
The authenticity of host '54.183.77.100 (54.183.77.100)' can't be established.
RSA key fingerprint is a6:53:a0:99:b8:61:ef:fe:05:d3:fe:47:90:ea:de:b6.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '54.183.77.100' (RSA) to the list of known hosts.
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/reedn/AMI.pem
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to 54.183.77.100 ([54.183.77.100]:22)
First you need make sure the keypair has been applied to instance #2. Something like below in aws console on this instance:
Key pair name: AMI (should be same as instance #1)
Then try below steps:
If this ec2 instance is not in VPC, could you stop and start the instance to refresh with new public IP address and try again?
clean content in .ssh/known_hosts in your local machine, and try again.
One of them should work for you.
I'm a bit lost with Amazon EC2. I just created an instance and generaited a pair of keys. I saved it on my win7 HDD.
I started a ssh connection through the terminal :
$ ssh -v -i EC2.pem instance_id#ec2-xx-xx-xx-xx.eu-west-1.compute.amazonaws.com
OpenSSH_4.6p1, OpenSSL 0.9.8e 23 Feb 2007
debug1: Connecting to ec2-xx-xx-xx-xx.eu-west-1.compute.amazonaws.com [54.76.160.55] port 22.
debug1: Connection established.
debug1: identity file EC2.pem type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6p1 Ubuntu-2ubuntu1
debug1: match: OpenSSH_6.6p1 Ubuntu-2ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.6
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'ec2-xx-xx-xx-xx.eu-west-1.compute.amazonaws.com' is known and matches the RSA host key.
debug1: Found key in /c/Users/FLE/.ssh/known_hosts:1
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: EC2.pem
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).
Doesn't seem to want to let me in.
When I try via putty, it answers Disconnected: No supported authentication methods available.
What is this ?
Thanks for helping.
Don't know the exact instance type you are trying to ssh into but the format should be "userid#ec2host.com" - you appear to be using instance id instead. Should look something like this:
ssh -i my-key-pair.pem ec2-user#ec2-198-51-100-1.compute-1.amazonaws.com
ec2-user is the default user for Amazon Linux, ubuntu is the default for all the ubuntu instance typers.
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.html
I'm trying to connect to my EC2 Instances on Amazon. When you connect an error - Permission denied (publickey). Installing cmhod 400 myPem.pem file does not help.
Connection log:
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 debug1: Reading
configuration data /etc/ssh_config debug1: /etc/ssh_config line 20:
Applying options for * debug1: Connecting to 54.214.31.168
[54.214.31.168] port 22. debug1: Connection established. debug1:
identity file wenglePemNew.pem type -1 debug1: identity file
wenglePemNew.pem-cert type -1 debug1: Enabling compatibility mode for
protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.2 debug1:
Remote protocol version 2.0, remote software version OpenSSH_5.9p1
Debian-5ubuntu1 debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1 pat
OpenSSH_5* debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT
received debug1: kex: server->client aes128-ctr hmac-md5 none debug1:
kex: client->server aes128-ctr hmac-md5 none debug1:
SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent debug1: expecting
SSH2_MSG_KEX_DH_GEX_GROUP debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY debug1: Server host key:
RSA (code) The authenticity of host '54.214.31.168 (54.214.31.168)'
can't be established. RSA key fingerprint is (code). Are you sure you
want to continue connecting (yes/no)? yes Failed to add the host to
the list of known hosts (/Users/oktolab/.ssh/known_hosts). debug1:
ssh_rsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server debug1: SSH2_MSG_SERVICE_REQUEST
sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications
that can continue: publickey debug1: Next authentication method:
publickey debug1: Trying private key: wenglePemNew.pem debug1: read
PEM private key done: type RSA debug1: Authentications that can
continue: publickey debug1: No more authentication methods to try.
Permission denied (publickey).
AMI creation and deployment of a new instance with a new pem file did not help.
What's need to do to connect to the server?
Failed to add the host to the list of known hosts (/Users/oktolab/.ssh/known_hosts)
What are the permission for /Users/oktolab/.ssh/known_hosts ?
Run below command to fix the permission:
chmod 0600 /Users/oktolab/.ssh/known_hosts
Also, could you provide the exact SSH command that you are running because:
read PEM private key done: type RSA debug1: Authentications that can continue: publickey debug1: No more authentication methods to try. Permission denied (publickey).
A lot of time above error appears if you use ec2-user instead of ubuntu as username and vice-versa. In your case, this seems to be ubuntu image so it should be ubuntu. These things will be clarified once you provide the exact ssh command you are running
I know there are alot of questions regarding AWS & SSH sessions, and I've attempted to make use of them, but all have failed.
I have an instance running, and the ssh string given by the EC2 Management Console is
ssh -i -v jason.pem ubuntu#ec2-54-227-167-156.compute-1.amazonaws.com
which produces the output
OpenSSH_5.9p1 Debian-5ubuntu1.1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to ec2-54-227-167-156.compute-1.amazonaws.com [54.227.167.156] port 22.
debug1: Connection established.
debug1: identity file jason.pem type -1
debug1: identity file jason.pem-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian- 5ubuntu1
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA ea:b6:50:fe:49:49:90:76:03:91:21:6d:73:0e:04:d2
debug1: Host 'ec2-54-227-167-156.compute-1.amazonaws.com' is known and matches the ECDSA host key.
debug1: Found key in /home/jason/.ssh/known_hosts:27
debug1: ssh_ecdsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Trying private key: jason.pem
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).
I've done the following:
Created new keypair, downloaded jason.pem and set to 0400 chmod permissions
Added ChallengeResponseAuthentication yes to /etc/ssh/ssh_config
What exactly is going on, and why is the jason.pem file not being accepted?
The public key on your instance doesn't align with your private keypair. If that instance's configuration is important and you want to keep it (I say this based upon the fact that you shutdown the instance rather than just creating a new one):
Create a new keypair
Create an AMI of the instance you want to access
Create a new instance from that AMI using the new keypair
Attempt to ssh into it again using the new downloaded keypair
400 permissions should be fine for the keypair.
I was connecting my ec2 instance via ssh well,after adding new EBS volume restarted the machine by 'sudo shutdown -r now'
And after that I tried to access by using follwing command:
ssh -v -i primary_key.pem ubuntu#ec2-23-22-245-160.compute-1.amazonaws.com
which is retuning like below:
OpenSSH_5.6p1, OpenSSL 0.9.8r 8 Feb 2011
debug1: Reading configuration data /Users/caveman/.ssh/config
debug1: Reading configuration data /etc/ssh_config
debug1: Applying options for *
debug1: Connecting to ec2-23-22-245-160.compute-1.amazonaws.com [23.22.245.160] port 22.
debug1: Connection established.
debug1: identity file primary_key.pem type -1
debug1: identity file primary_key.pem-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian-5ubuntu1
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'ec2-23-22-245-160.compute-1.amazonaws.com' is known and matches the RSA host key.
debug1: Found key in /Users/caveman/.ssh/known_hosts:31
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: primary_key.pem
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).
What is wrong?Any point that I am missing?
This is normal Amazon EC2 behaviour. After restarting the instance, associated public Ip (yours was ec2-23-22-245-160.compute-1.amazonaws.com) will be changed.
There are 2 way to connect your instance via ssh
Log into your Amazon AWS Console and check running instance then copy Public DNS and try to connect with ssh. (ssk key is the same)
If you don't want your instance's public ip to change on every restart/termination use Elastic IP. Elastic Ips associated with account (not the instance) so you can assign Elastic Ip on any instance you want.
You can connect with ssh ssh -v -i primary_key.pem ubuntu#<ElasticIp>
I had the similar issue. Here is what I did..!
ssh -i < .pem file> -vvv <server IP>
The above command will show debug logs and after ECDSA key is accepted you are in.