AWS ssh access 'Permission denied (publickey)' issue

Question

How to connect to a AWS instance through ssh?

I have:

Signed up at AWS;
Created a public key and a certificate at AWS website and saved them to disk;

Went to my console and created environment variables:

$ export JAVA_HOME=/usr/lib/jvm/java-6-openjdk/
$ export EC2_CERT=/home/default/aws/cert-EBAINCRNWHDSCWWIHSOKON2YWGJZ5LSQ.pem
$ export EC2_PRIVATE_KEY=/home/default/aws/pk-EBAINCRNWHDSCWWIHSOKON2YWGJZ5LSQ.pem

Told AWS API to use this keypair and saved the keypair to file:
```
$ ec2-add-keypair ec2-keypair > ec2-keypair.pem
```
Started an AWS Ubuntu 9 instance using this keypair:
```
$ ec2-run-instances ami-ed46a784 -k ec2-keypair
```

Attempted to establish a ssh connection to the instance:

$ ssh -v -i ec2-keypair.pem ubuntu@ec2-174-129-185-190.compute-1.amazonaws.com
OpenSSH_5.1p1 Debian-5ubuntu1, OpenSSL 0.9.8g 19 Oct 2007
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Applying options for *
debug1: Connecting to ec2-174-129-185-190.compute-1.amazonaws.com [174.129.185.190] port 22.
debug1: Connection established.
debug1: identity file ec2-keypair.pem type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.1p1 Debian-5ubuntu1
debug1: match: OpenSSH_5.1p1 Debian-5ubuntu1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.1p1 Debian-5ubuntu1
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'ec2-174-129-185-190.compute-1.amazonaws.com' is known and matches the RSA host key.
debug1: Found key in /home/default/.ssh/known_hosts:11
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: ec2-keypair.pem
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).

What could be the problem and how to make it work?

Ironic is that I use "root" as user name but "ubuntu" (what you mentioned) is the right name for my AMI, and thank you for your post! — realjin, Feb 15 '12 at 14:33
possible duplicate of [Permission denied (publickey) when SSH Access to Amazon EC2 instance](http://stackoverflow.com/questions/18551556/permission-denied-publickey-when-ssh-access-to-amazon-ec2-instance) — CtheGood, Jul 29 '15 at 15:36

score 551 · Accepted Answer · edited Apr 22 '13 at 01:45

551

For Ubuntu instances:

chmod 600 ec2-keypair.pem
ssh -v -i ec2-keypair.pem ubuntu@ec2-174-129-185-190.compute-1.amazonaws.com

For other instances, you might have to use ec2-user instead of ubuntu.

Most EC2 Linux images I've used only have the root user created by default.

See also: http://www.youtube.com/watch?v=WBro0TEAd7g

edited Apr 22 '13 at 01:45

Dave Jarvis

30,436
41
178
315

answered Sep 21 '09 at 13:58

sipsorcery

30,273
24
104
155

52

You can also use ssh-add ec2-keypair.pem so you can drop the -i option – AdamK Sep 21 '09 at 15:27
We're having the same problem - when we use root, it tells us to log back in as ubuntu... but as ubuntu it just fails as the above example. – Taryn East Sep 25 '10 at 18:46
12

if you try root and you get "Please login as the ec2-user user rather than root user.'" use **ec2-user** in place of root. – Tony Jun 24 '11 at 11:27
Cheesy is right, however at least the -v option helped figuring this out. Thanks to both of you! – Thiago Ganzarolli Apr 25 '12 at 14:52
8

And some Ubuntu images seem to have the "ubuntu" user only. (Which can sudo to root.) – Prof. Falken Apr 26 '12 at 08:50
@AdamK "You can also use ssh-add ec2-keypair.pem so you can drop the -i option", so can i login through putty in windows also ??? – Ashok KS Jun 13 '13 at 05:54
@AshokKS To log in with Putty you should download PuttyGen and convert your .pem file to a .ppk (putty format). Then use the .ppk via Pagent or in the 'Auth' portion of Putty. – Aman Chawla Jan 02 '14 at 22:18
Thank you for your answer. It blows my mind that Amazon still hasn't updated their documentations to make this little known fact more known :) They don't actually mention the need to have a user@... Maybe assuming people would remember. – Kirill Aug 26 '14 at 22:09
for Amazon Linux AMI, you will need to use ec2-user@ like ssh -v -i ec2-keypair.pem ec2-user@ec2-174-129-185-190.compute-1.amazonaws.com – sarabdeep singh Oct 26 '14 at 15:57
ubuntu@ worked for me. ec2-user did not. – acoustic_north Jan 17 '15 at 17:21
On file mode 600, see also https://stackoverflow.com/a/21625290/843660 – dskrvk Feb 26 '16 at 15:58
Currently for security reasons it should be: chmod 400 ec2-keypair.pem – acquayefrank Jul 15 '16 at 11:58
LOLing at the fact that this went back to 2009. I just had the same issue, i usually go with Amazon Linux but went with Ubuntu this time around cause i wanted to use `authbind` (not available on Yum). Why can't they have one username set for all environments? – Stephen Tetreault Feb 12 '17 at 16:12

score 94 · Answer 2 · edited Jul 03 '12 at 17:31

94

Now it's:

ssh -v -i ec2-keypair.pem ec2-user@[yourdnsaddress]

edited Jul 03 '12 at 17:31

answered Dec 03 '10 at 03:03

SSH

2,533
16
21

Thanks. It took me ages to find this out - it's not mentioned in the connect info from the console! It does tell you when you try to use root, but I thought ec2-user was a reference to my username. Doh! – Adrian Mouat Jan 13 '12 at 16:37

score 48 · Answer 3 · answered Nov 04 '10 at 02:59

48

Canonical's releases use the user 'ubuntu' by default for anyone landing here with a ubuntu image that is coming up with the same problem.

answered Nov 04 '10 at 02:59

bryon

481
4
2

score 22 · Answer 4 · answered Dec 26 '11 at 04:13

22

If you're using a Bitnami image, log in as 'bitnami'.

Seems obvious, but something I overlooked.

answered Dec 26 '11 at 04:13

akim

341
3
5

2

Did you mean? `Seems obvious` – Bob Stein Nov 09 '15 at 20:11
[Bitnami instructions](https://bitnami.com/aws-credentials), including how to find the database passwords. – Bob Stein Nov 09 '15 at 20:49
This made my day. – Hossein Heydari Sep 25 '21 at 20:09

score 9 · Answer 5 · answered Oct 07 '11 at 23:11

9

For my ubuntu images, it is actually ubuntu user and NOT the ec2-user ;)

answered Oct 07 '11 at 23:11

Dean Hiller

19,235
25
129
212

score 5 · Answer 6 · answered May 16 '12 at 02:28

5

It will also complain if the pem file permissions are too open. chmod the file to 600 to fix that.

answered May 16 '12 at 02:28

Allan Bogh

605
8
15

4

For novices.. the command to do this would be: `chmod 600 your_file.pem` – dano Jan 28 '13 at 00:11

score 5 · Answer 7 · answered Jul 12 '13 at 00:04

I was also running into this - turns out I was using a community-created AMI - and the default username was niehter root, nor was it ect-user or ubuntu. In fact, I had no idea what it was - till I tried 'root' and the server kindly asked me to login as xxx where xxx is whatever it tells you.

-cheers!

score 5 · Answer 8 · answered Feb 25 '14 at 03:28

If you are running AWS image from Bitnami. The username would be bitnami. Cheers!

see my debug and look at the last one:

*

ssh -v -i awsliferaysrta.pem.txt root@54.254.250.***
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to 54.254.250.*** [54.254.250.***] port 22.
debug1: Connection established.
debug1: identity file awsliferaysrta.pem.txt type -1
debug1: identity file awsliferaysrta.pem.txt-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1 Debian-5ubuntu1.1
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1.1 pat OpenSSH_5*
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 05:5c:78:45:c9:39:3a:84:fe:f8:19:5d:31:48:aa:5f
debug1: Host '54.254.250.***' is known and matches the RSA host key.
debug1: Found key in /Users/macbookpro/.ssh/known_hosts:2
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: awsliferaysrta.pem.txt
debug1: read PEM private key done: type RSA
debug1: Authentication succeeded (publickey).
Authenticated to 54.254.250.*** ([54.254.250.***]:22).
debug1: channel 0: new [client-session]
debug1: Requesting no-more-sessions@openssh.com
debug1: Entering interactive session.
debug1: Remote: Port forwarding disabled.
debug1: Remote: Agent forwarding disabled.
debug1: Remote: X11 forwarding disabled.
debug1: Remote: Forced command.
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
Please login as the user "bitnami" rather than the user "root".

*

score 5 · Answer 9 · answered Jan 03 '16 at 12:36

You need have your private key in your local machine

You need to know the IP address or DNS name of your remote machine or server, you can get this from AWS console

If you are a linux user

Make sure the permissions on the private key are 600 (chmod 600 <path to private key file>)
Connect to your machine using ssh (ssh -i <path to private key file> <user>@<IP address or DNS name of remote server>)

If you are a windows user

Use PuTTy to create the ssh session (http://the.earth.li/~sgtatham/putty/latest/x86/putty-0.66-installer.exe)
If your private key file is in .pem format convert it into .ppk using puttygen
Launch PuTTy, set you ppk file, IP address or DNS name of the remote server and start the ssh session

Change the permission of the file using chmod 400 – Vaibhav Jain Jun 02 '16 at 13:19 — Vaibhav Jain, Jun 02 '16 at 13:19

carl crott · Answer 10 · 2011-05-29T04:44:36.297

5

Ubuntu 10.04 with openSSH

this is the exact usage:

ssh -v -i [yourkeypairfile] ec2-user@[yourdnsaddress]

for example:

ssh -v -i GSG_Keypair.pem ec2-user@ec2-184-72-204-112.compute-1.amazonaws.com

above example was taken directly from the AWS tutorial for connecting to a Linux/UNIX machine at: http://docs.amazonwebservices.com/AWSEC2/latest/GettingStartedGuide/

edited May 29 '11 at 04:44

answered May 28 '11 at 22:02

carl crott

753
1
9
21

With ssh -i switch we can use .pem file only. – ABHAY JOHRI Dec 18 '17 at 14:12

gaurav rajput · Answer 11 · 2015-06-02T11:20:48.200

4

use...

# chmod 400 ec2-keypair.pem

don't use the 600 permission otherwise you might overwrite your key accidently.

edited Jun 02 '15 at 11:20

answered Feb 07 '14 at 10:29

gaurav rajput

212
1
3

score 3 · Answer 12 · answered Feb 12 '14 at 08:22

3

For Debian EC2 instances, the user is admin.

answered Feb 12 '14 at 08:22

Alastair Irvine

1,166
12
16

score 3 · Answer 13 · answered Feb 22 '15 at 23:46

There are 2 steps to be connected:

Chmod 400 on your private key, like this the others cannot access to your key:

chmod 400 toto.pem

To connect to your instance in SSH, you need to know the public IP address of your instance :

ssh -i toto.pem ec2-user@XX.XX.XX.XXX

Hope it helps !

score 2 · Answer 14 · answered Feb 04 '13 at 15:51

this worked for me:

ssh-keygen -R <server_IP>

to delete the old keys stored on the workstation also works with instead of

then doing the same ssh again it worked:

ssh -v -i <your_pem_file> ubuntu@<server_IP>

on ubuntu instances the username is: ubuntu on Amazon Linux AMI the username is: ec2-user

I didn't have to re-create the instance from an image.

score 2 · Answer 15 · answered Jan 03 '14 at 06:24

2

Permission for ec2-keypair.pem should be 400

chmod 400 ec2-keypair.pem

answered Jan 03 '14 at 06:24

Yogesh

663
8
17

score 1 · Answer 16 · answered Dec 04 '13 at 23:29

If you are using EBS, you can also try to mount the EBS Volume on a running instance. Then mount it on that running instance and see what's going on in /home. You can see things like is the user ubuntu or ec2-user ? or does it have the right public keys under ~/.ssh/authorized_keys

score 1 · Answer 17 · answered Aug 13 '15 at 15:36

1

In my case (Mac OS X), the problem was the file's break type. Try this:

1.- Open the .pem file with TextWrangler

2.- At Bottom of app, verify if the Break Type is "Windows(CRLF)".

answered Aug 13 '15 at 15:36

pmartinezd

31
1

score 1 · Answer 18 · answered Aug 23 '15 at 13:09

1

Its ec2-user for Amazon Linux AMI's and ubuntu for Ubuntu images. Also, RHEL 6.4 and later ec2-user RHEL 6.3 and earlier root Fedora ec2-user Centos root

answered Aug 23 '15 at 13:09

Amith Ajith

183
1
12

score 0 · Answer 19 · answered Jun 13 '13 at 18:35

Just adding to this list. I was having trouble this morning with a new user just added to an AWS EC2 instance. To cut to the chase, the problem was selinux (which was in enforcing mode), together with the fact that my user home dir was on a new EBS attached volume. Somehow I guess selinux doesn't like that other volume. Took me a while to figure out, as I looked through all the other usual ssh issues (/etc/ssh/sshd_config was fine, of course no password allowed, permissions were right, etc.)

The fix?

For now (until I understand how to allow a user to ssh to a different volume, or somehow make that volume a bona fide home dir point):

sudo perl -pi -e 's/^SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config
sudo setenforce 0

That's it. Now my new user can log in, using his own id_rsa key.

score 0 · Answer 20 · answered Sep 27 '13 at 03:36

0

Had the same issue. Permission denied (publickey) when trying to login in with 'ec2-user' or with 'root'.

Googled the AMI number of the machine image and it had the SSH login information right their on the Debian wiki page.

Hope this helps.

answered Sep 27 '13 at 03:36

Lionel Morrison

566
4
15

AWS ssh access 'Permission denied (publickey)' issue

20 Answers20

Linked

Related