AWS EC2 forgot password and not able to use SSH

Question

I have an ec2-ubuntu instance. And now I forgot the password for the user. Unfortunately i've also lost the .pem file and .ppk file i used to use with putty. And finding it difficult to get in. I want to upgrade some code of mine in that.

I've gone through following links giving suggestions as to what can be done.

1. aws-gaining-ssh-access-to-an-ec2-instance-you-lost-access-to

2. add-keypair-to-existing-ec2-instance

3. locked-myself-out-root-account-ec2-ubuntu-instance

4. ec2-fix-ebs-root

I've additional constraint that the private i/p address of system should not change.One of the software I'm using uses system private i/p address for license. And currently my instance has only one volume and is root volume.

Based on the links mentioned above, I need to detach my volume and attach to other instance. Make required changes for access. And the reattach to original instance. However since the volume in my case is root volume, I need to stop the instance and then detach it. If my understanding is correct, this can cause change in private i/p address of instance.

Would like to know if there is some thing that can be done? Or following the steps mentioned in links is the only way and then update s/w license on instance restart?

thanks

Answer 1

Note: Stop/Start of EC2 instance will change the IP address (just read that the OP needed the IP to remain unchanged).

This works for me for AWS EC2 Ubuntu 18.04.

• generate new keypair (use putty key generator or - if in a hurry - an online generator).
• insert the generated ssh-rsa ... public key into the script below
• Stop instance
• set the instance user data to this cloud init script

#cloud-config
bootcmd:
 - echo 'ssh-rsa AAAAB3Nz...' > /root/.ssh/authorized_keys

• Start instance
• test connection
• stop instance again and delete the user data (you will probably forget to do this)

Notes and warnings

• AWS cloud init docs
• cloud init docs & examples
• Spaces seem to be important in cloud init scripts, resist the urge to format, like for example inserting a space after the hash in #cloud-config
• I fiddled with cloud-init-per once, but never got it working, just wasted a lot of time
• You could use >> instead of > to append the key instead of overwriting the authorized_keys file. But if you botched the contents during previous attempts, you will never know why it doesn't work.
• You can change the script to push the key of any user, e.g. for the default EC2 ubuntu user: echo 'ssh-rsa ...' > /home/ubuntu/.ssh/authorized_keys
• Beware of installed key rotation agents like e.g. JumpCloud, which will potentially overwrite the authorized_keys file. For JumpCloud, you could change the script to write to echo 'ssh-rsa ...' > /home/ubuntu/.ssh/authorized_keys.jcorig (JumpCloud includes the contents of that file)
• Ubuntu has to be configured to allow SSH connections (should be the default)
• The SSH port needs to be open (Ubuntu firewall)
• The security group (AWS firewall) of the instance needs to allow the SSH port and your IP
• The whole process can be automated (stop, set user data, start, connect and fix, stop, clear userdata, start). The interesting AWS command is (Java client):

m_ec2.modifyInstanceAttribute(new ModifyInstanceAttributeRequest().withInstanceId("<instance-id>").withUserData(userdataBase64));

Answer 2

My suggestion is:

1. Take an snapshot of the instance (create an AMI).
2. Launch a new instance with that AMI and use a new key/pair.
3. Use Elastic IP Address, that way it wont change next time. Or use VPC as user1050134 suggested.

Answer 3

I think you have two options:

1. Create an AMI of the instance, launch it with a new key/pair and attach an elastic IP (recommended).
2. Or, detach the root volume, attach and mount it to another instance, then create a ssh key/pair and copy the contents of the public key to the /home/ubuntu/.ssh/authorized_keys file. Finally, try to login with the new generated private key and ubuntu user.

Answer 4

Ref : Resetting passwords on managed nodes

In case you are having an instance with a preinstalled SSM agent(SSM Agent preinstalled AMI) you can follow the below steps

Prerequisites

1. SSM Agent version 2.3.668.0 or later must be installed on the managed node.
2. Session Manage configuration : https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started.html Encryption : Turn on AWS Key Management Service (AWS KMS) complete
3. encryption for Session Manager data to use the password reset option for managed nodes.

To change the password on a managed node (console)

1. Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.

In the navigation pane, choose Fleet Manager.

-or-

2.If the AWS Systems Manager home page opens first, choose the menu icon ( ) to open the navigation pane, and then choose Fleet Manager in the navigation pane.

3.Choose the button next to the node that needs a new password.

4.In the Instance actions menu, choose Reset password.

5.For User name, enter the name of the user for which you're changing the password. This can be any user name that has an account on the node.

6.Choose Submit.

Follow the prompts in the Enter new password command window to specify the new password.