amazon web services - with - Trying to SSH into an Amazon Ec2 instance-permission error




server refused our key aws (18)

This is probably a stupidly simple question to some :)

I've created a new linux instance on Amazon EC2, and as part of that downloaded the .pem file to allow me to SSH in.

When I tried to ssh with:

ssh -i myfile.pem <public dns>

I got:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for 'amazonec2.pem' are too open.
It is recommended that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: amazonec2.pem
Permission denied (publickey).

Following this post I tried to chmod +600 the pem file, but now when I ssh I just get:

Permission denied (publickey).

What school-boy error am I making here? The .pem file is in my home folder (in osx). It's permissions look like this:

[email protected]   1 mattroberts  staff    1696 19 Nov 11:20 amazonec2.pem

Alternative log-in using PuTTY. Its good but needs a few steps.

  1. Get your .pem that was generated when you first made the EC2 instance.
  2. Convert the .pem file .ppk using PuttyGen since PuTTY does not read .pem.
  3. Open PuTTY and enter your Host Name which is your instance username + Public DNS (Ex. [email protected]). Not your AWS account username.
  4. Then navigate to Connection > SSH > Auth. Then add your .ppk file. Click on Browse where it says "Private key file for authentication".
  5. Click Open and you should be able to immediately establish connection.

Im using PuTTY 0.66 in Windows.


BY default permission are not allowing the pem key. You just have to change the permission:

chmod 400 xyz.pem

and if ubuntu instance then connect using:

ssh -i xyz.pem [email protected]


Checklist:

  1. Are you using the right private key .pem file?

  2. Are its permissions set correctly? (My Amazon-brand AMIs work with 644, but Red hat must be at least 600 or 400. Don't know about Ubuntu.)

  3. Are you using the right username in your ssh line? Amazon-branded = "ec2-user", Red Hat = "root", Ubuntu = "ubuntu". User can be specified as "ssh -i pem [email protected]" OR "ssh -l username -i pem hostname"



I have seen two reasons behind this issue

1) access key does not have the right permission. pem keys with default permission are not allowed to make a secure connection. You just have to change the permission:

chmod 400 xyz.pem

2) Also check whether you have logged-in with proper user credentials. Otherwise, use sudo while connecting

sudo ssh -i {keyfile} [email protected]{ip address of remote host}


I know this is very late to the game ... but this always works for me:

step 1

ssh-add ~/.ssh/KEY_PAIR_NAME.pem

step 2, simply ssh in :)

ssh [email protected]<instance public dns/ip>

e.g.

ssh [email protected]

hope this helps someone.


In Mac terminal, doing "chmod 400 xyz.pem" did not help me, it kept saying permission denied. For ubuntu users I would suggest

  1. ssh-add xyz.pem
  2. ssh -i xyz.pem [email protected] (notice the user is ubuntu)

In addition to the other answers, here is what I did in order for this to work:

  • Copy the key to .ssh folder if you still hadn't:

cp key.pem ~/.ssh/key.pem

  • Give the proper permissions to the key

chmod 400 ~/.ssh/key.pem

  • Start ssh-agent (Thanks to https://.com/a/17848593 )

eval `ssh-agent -s` ssh-add

  • Then, add the key

ssh-add ~/.ssh/key.pem

Now you should be able to ssh EC2 (:


It is just a permission issue with your aws pem key.

Just change the permission of pem key to 400 using below command.

chmod 400 pemkeyname.pem

If you don't have permission to change the permission of a file you can use sudo like below command.

sudo chmod 400 pemkeyname.pem

I hope this should work fine.


Just change the permission of pem file to 0600 allowing only for the allowed user and it will work like charm.

sudo chmod 0600 myfile.pem

And then try to ssh it will work perfectly.

ssh -i myfile.pem <<ssh_user>>@<<server>>

Ok man, the only thing that worked for me was:

  1. Change permissions of the key

    chmod 400 mykey.pem

  2. Make sure to log in using ec2-user, and the correct ec2-99... address. The ec2-99 address is at the bottom of the aws console when you're logged in and seeing your instance listed

    ssh -i mykey.pem [email protected]


SSH keys and file permission best practices:

  • .ssh directory - 0700 (only by owner)
  • private key/.pem file - 0400 (read only by owner)
  • public key/.pub file - 0600 (read & write only by owner)

    chmod XXXX file/directory


The issue for me was that my .pem file was in one of my NTFS partitions. I moved it to my linux partition (ext4).

Gave required permissions by running:

chmod 400 my_file.pem

And it worked.


The problem is having wrong mod on the file.

Easily solved by executing -

chmod 400 mykey.pem

Taken from Amazon's instructions -

Your key file must not be publicly viewable for SSH to work. Use this command if needed: chmod 400 mykey.pem


This error is only because of permission.

Just give the permission 600

#chmod 600 pemfilepath


Well, looking at your post description I feel there were 2 mistakes done by you:-

  1. Set correct permissions for the private key. Below command should help you to set correct file permision.

    chmod 0600 mykey.pem

  2. Wrong ec2 user you are trying to login.

    Looking at your debug log I think you have spawned an Amazon linux instance. The default user for that instance type is ec2-user . If the instance would have been ubuntu then your default user would have been ubuntu .

    ssh -i privatekey.pem [email protected]_ip

Note:
   For an Amazon Linux AMI, the default user name is ec2-user.

   For a Centos AMI, the default user name is centos.

   For a Debian AMI, the default user name is admin or root.

   For a Fedora AMI, the default user name is ec2-user or fedora.

   For a RHEL AMI, the default user name is ec2-user or root.

   For a SUSE AMI, the default user name is ec2-user or root.

   For an Ubuntu AMI, the default user name is ubuntu.

   Otherwise, if ec2-user and root don't work, check with the AMI provider.

source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.html


You are likely using the wrong username to login:

  • most Ubuntu images have a user ubuntu
  • Amazon's AMI is ec2-user
  • most Debian images have either root or admin

To login, you need to adjust your ssh command:

ssh -l USERNAME_HERE -i .ssh/yourkey.pem public-ec2-host

HTH


ssh -i /.pem [email protected]

I think it's because either you have entered wrong credentials or, you are using a public key rather than private key or, your port permissions are open for ALL to ssh. This is bad for Amazon.





permissions